Flickr Account Takeover using AWS Cognito API Analysed #1342088 Valid Authentication – 2021-12-18 – 440 Arbitrary file read via ffmpeg HLS parser at https://www.flickr.com/photos/upload Analysed #487008 Valid Command and Code Injection – 2020-01-25 – 340 critical server misconfiguration lead to access to any user sensitive data which include user email and password #1365738 Valid Input Validation and Logic – 2021-11-02 $500 116 CSRF in Account Deletion feature (https://www.flickr.com/account/delete) #615448 Valid Cross-Site Request Forgery – 2021-09-14 – 92 High resource consumption by insufficient sanitization of forum threads pagination #1916400 Valid Denial of Service Medium 2025-11-24 $479 75 Incorrect Deep-link validation leading to unresponsive application and device #1157795 Valid Input Validation and Logic Medium 2024-07-06 – 64 IDOR may allow access to non-public photos #1737943 Valid Insecure Direct Object Reference Medium 2024-07-06 – 61 Stored XSS in photos_user_map.gne #1534636 Valid Cross-site Scripting – 2022-05-23 $3,263 54 Critical broken cookie signing on dagobah.flickr.com #1440290 Valid Input Validation and Logic – 2022-05-24 $479 30 Open redirect bypass #1513031 Valid Open Redirect – 2022-05-23 $300 28 Open Redirect #1581258 Valid Open Redirect – 2022-09-29 $258 15 Improper access control in place for "member only" groups via root.YUI_config.flickr.api.site_key #587733 Valid Access Control – 2021-05-03 – 15 Open redirect GET-Based on https://www.flickr.com/browser/upgrade/?continue= #1217570 Valid Open Redirect – 2022-03-16 $150 13 Stored open redirect in about page #979375 Valid Open Redirect – 2021-05-03 – 13