Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Bypassing 2FA for BTC transfersAnalysed#10554 | Valid | Authentication | – | 2014-09-25 | $1,000 | 18 |
| Coinbase Android Application - Bitcoin Wallet Leaks OAuth Response CodeAnalysed#5314 | Valid | Information Disclosure | – | 2014-11-26 | – | 14 |
| Coinbase Android Security Vulnerabilities#5786 | Informative | Cryptography | – | 2014-05-07 | – | 9 |
| Leaking CSRF token over HTTP resulting in CSRF protection bypass#15412 | Valid | Cross-Site Request Forgery | – | 2014-10-16 | $1,000 | 7 |
| 2FA settings allowed to be changed with no delay/freeze on funds#16696 | Informative | Misconfiguration and Insecure Design | – | 2014-08-25 | – | 5 |
| Simultaneous Session Logon : Improper Session Management#11722 | Informative | Authentication | – | 2014-08-26 | – | 4 |
| User Enumeration, Information Disclosure and Lack of Rate Limitation on API#5200 | Informative | Misconfiguration and Insecure Design | – | 2014-03-31 | – | 4 |
| CSRF on "Set as primary" option on the accounts page#10563 | Valid | Cross-Site Request Forgery | – | 2014-07-26 | $100 | 3 |
| Multiple Issues related to registering applications#5933 | Valid | Misconfiguration and Insecure Design | – | 2014-05-29 | $1,000 | 3 |
| Information Disclosure That shows the webroot of CoinBase Server#5073 | Informative | Information Disclosure | – | 2014-05-04 | – | 3 |
| 2 factor authentication design flaw#7369 | Valid | Misconfiguration and Insecure Design | – | 2014-06-06 | – | 2 |
| IFRAME loaded from External Domains#5205 | Informative | No weakness recorded | – | 2014-04-30 | – | 2 |
| Cookie missing the HttpOnly flag#5204 | Informative | No weakness recorded | – | 2014-04-30 | – | 2 |
| Improper Validation of the Referrer header leading to Open URL Redirection#5199 | Informative | Open Redirect | – | 2014-04-29 | – | 2 |
| CSRF in function "Set as primary" on accounts page#10829 | Valid | Cross-Site Request Forgery | – | 2014-06-06 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.