Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
16 of 15,219 reports · $5,429 in bounties · 227 analysed so far
- #1342088ValidAnalysedFlickr Account Takeover using AWS Cognito APIFlickr · Authentication · 2021 · needs: a user account · Account takeover chain, Authentication bypass, E-mail verification bypass–440votes
- #487008ValidAnalysedArbitrary file read via ffmpeg HLS parser at https://www.flickr.com/photos/uploadFlickr · Command and Code Injection · 2020 · needs: a user account · Path traversal, Local file inclusion–340votes
- #1365738Validcritical server misconfiguration lead to access to any user sensitive data which include user email and passwordFlickr · Input Validation and Logic · 2021$500116votes
- #615448ValidCSRF in Account Deletion feature (https://www.flickr.com/account/delete)Flickr · Cross-Site Request Forgery · 2021–92votes
- #1916400ValidHigh resource consumption by insufficient sanitization of forum threads paginationFlickr · Denial of Service · 2025 · Medium$47975votes
- #1157795ValidIncorrect Deep-link validation leading to unresponsive application and deviceFlickr · Input Validation and Logic · 2024 · Medium–64votes
- #1737943ValidIDOR may allow access to non-public photosFlickr · Insecure Direct Object Reference · 2024 · Medium–61votes
- #1534636ValidStored XSS in photos_user_map.gneFlickr · Cross-site Scripting · 2022$3,26354votes
- #2888001InformativeInformation Disclosure: .dockerignore file is publicly accessibleFlickr · No weakness recorded · 2025 · None–45votes
- #1440290ValidCritical broken cookie signing on dagobah.flickr.comFlickr · Input Validation and Logic · 2022$47930votes
- #1513031ValidOpen redirect bypassFlickr · Open Redirect · 2022$30028votes
- #1581258ValidOpen RedirectFlickr · Open Redirect · 2022$25815votes
- #587733ValidImproper access control in place for "member only" groups via root.YUI_config.flickr.api.site_keyFlickr · Access Control · 2021–15votes
- #1217570ValidOpen redirect GET-Based on https://www.flickr.com/browser/upgrade/?continue=Flickr · Open Redirect · 2022$15013votes
- #979375ValidStored open redirect in about pageFlickr · Open Redirect · 2021–13votes
- #1755552InformativeExceed photo dimensions, Flickr.comFlickr · No weakness recorded · 2022–9votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.