Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Authentication IssueAnalysed#176979 | Valid | Access Control | Low | 2017-01-05 | $200 | 27 |
| [buy.coinbase.com]Content InjectionAnalysed#218680 | Valid | No weakness recorded | Low | 2017-05-25 | – | 26 |
| Captcha Bypass in Coinbase SignUp FormAnalysed#246801 | Valid | Misconfiguration and Insecure Design | Low | 2017-09-05 | $100 | 23 |
| XSSI (Cross Site Script Inclusion)Analysed#118631 | Valid | Cross-Site Request Forgery | – | 2017-08-22 | – | 15 |
| Requestor Email Disclosure via Email Notification#202361 | Informative | Information Disclosure | Low | 2017-02-02 | – | 13 |
| Information disclosure same issue #176002#248599 | Valid | No weakness recorded | Low | 2017-07-21 | $100 | 7 |
| Content Injection error page#148952 | Informative | Misconfiguration and Insecure Design | – | 2017-01-05 | – | 6 |
| Open redirect on sign in#231760 | N/A | Open Redirect | Low | 2017-06-23 | – | 3 |
| Csrf bug on signup session#230428 | Informative | Cross-Site Request Forgery | – | 2017-08-30 | – | 2 |
| New Device Confirmation Bug#266288 | Informative | No weakness recorded | – | 2017-09-08 | – | 1 |
| X-Frame-Options#237071 | Informative | Misconfiguration and Insecure Design | None | 2017-06-22 | – | 1 |
| Information disclosure in coinbase android app#192197 | Informative | Authentication | Low | 2017-08-30 | – | 1 |
| Inaccurate Payment receipt#121417 | Informative | No weakness recorded | – | 2017-08-30 | – | 1 |
| Device confirmation Flaw#254869 | Informative | No weakness recorded | None | 2017-08-02 | – | – |
| CSRF bug on password change#230436 | N/A | Cross-Site Request Forgery | – | 2017-08-28 | – | – |
| Information disclosue in Android Application#201855 | Duplicate | Denial of Service | Low | 2017-08-30 | – | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.