Take over of accounts created using Google or Facebook Analysed #442901 Valid Cross-Site Request Forgery Critical 2019-05-17 – 184 1-Click Account Takeover via Open Redirect through Regex Bypass in Domain Validation Analysed #3723458 Valid Access Control Critical 2026-06-20 – 126 Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeovers Analysed #419891 Valid Cross-Site Request Forgery High 2019-06-22 – 111 Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover ) Analysed #3080597 Valid Cryptography Critical 2025-05-07 – 107 Leaked reused password for a few Khan Academy users Analysed #3099978 Valid Cryptography High 2025-07-12 – 92 337k users and 1 employee leaked credentials Analysed #3250691 Valid Information Disclosure High 2025-09-10 – 87 XSS on using the legacy "Graphie To Png" API Analysed #2846011 Valid Cross-site Scripting Critical 2025-02-06 – 86 Text Injection/ Content Spoofing on https://cloud.e.khanacademy.org by breaking out of input tag. Analysed #2234420 Valid Misconfiguration and Insecure Design Low 2023-12-22 – 83 Account takeover by changing email Analysed #538800 Valid Cross-Site Request Forgery Critical 2019-05-17 – 80 Enumerate all the class codes via google dorking #1210043 Valid Access Control High 2021-07-22 – 44 Email Verification Bypass Allows Users to Add & verify Any Email As Guardians Email #1636552 Valid Access Control High 2022-12-17 – 42 S3 bucket takeover [learn2.khanacademy.org] #1777077 Valid No weakness recorded High 2022-12-29 – 35 xss due to incorrect handling of postmessages #1758132 Valid Cross-site Scripting Critical 2022-12-23 – 35 Login page vulnerable to bruteforce attacks via rate limiting bypass #1040471 Valid Authentication Low 2021-01-09 – 34 Client-Side Denial of Service (DoS) via Memory Exhaustion on Password Reset Endpoint #3987499 Valid Denial of Service High 2026-10-05 – 32 Subdomain takeover on healthyhackathon.khanacademy.org and hackweek.khanacademy.org #474798 Valid Access Control High 2019-08-25 – 30 Access to alerta.khanacademy.org leak sensitive data #1061664 Valid Access Control Critical 2021-09-08 – 29 Creating Unlimited Fake Accounts. #412677 Informative No weakness recorded Medium 2019-01-02 – 26 Client Side string length check #1244798 Valid Input Validation and Logic Medium 2023-10-14 – 25 Information can be changed without a password #721341 Valid Authentication High 2020-03-14 – 24 EMAIL SPOOFING #496360 Valid Access Control Medium 2022-01-02 – 22 [critical] sql injection by GET method #319279 Valid SQL Injection High 2018-03-06 – 22 Sensitive information/action is stored/done is done using a GET request #163820 Valid Cross-Site Request Forgery – 2019-06-23 – 20 Enumerate class codes via yahoo dork - Can access any course under teacher - Sensitive information leaked #1514356 Valid Information Disclosure High 2022-05-01 – 18 OPEN URL REDIRECT through PNG files #163272 Valid Cross-site Scripting Medium 2017-02-17 – 18 The endpoint /api/internal/graphql/requestAuthEmail on Khanacademy.or is vulnerable to Race Condition Attack. #1293377 Valid Input Validation and Logic Medium 2022-03-22 – 17 POST XSS in https://www.khanacademy.org.tr/ via page_search_query parameter #382321 Valid Cross-site Scripting Medium 2018-09-18 – 16 Bypass the fix of report #1078283 due to poor validation #1212337 Valid Open Redirect High 2021-07-08 – 14 CSV Injection Via Student Password/Name Leads To Client Side RCE And Reading Client Files #943255 Valid Command and Code Injection Medium 2020-08-27 – 12 https://mathfacts.khanacademy.org/ includes code from unprivileged localhost port #331752 Valid Command and Code Injection Medium 2019-05-25 – 12 Password authentication when changing information bypass. Bypass of report #721341 #1040373 Valid Authentication High 2021-02-11 – 11 Users can make accounts with a fake email address. #548587 Informative No weakness recorded Low 2019-04-25 – 11 Weak Ciphers Enabled #6488 Valid Information Disclosure – 2014-04-09 – 10 Unauthorised Account Detail Modification #868146 Valid Access Control High 2020-06-19 – 9 Cross site scripting (content-sniffing) #438953 Valid Cross-site Scripting Medium 2018-12-08 – 9 Possible Take Over Subdomain For Inbound Emails #403822 Valid No weakness recorded Medium 2018-11-08 – 9 Possible Subdomain Takeover #399165 Valid No weakness recorded Medium 2018-08-31 – 9 CSRF token fixation and potential account takeover #308394 Valid Misconfiguration and Insecure Design Medium 2018-04-19 – 9 XSS through document projects #244902 Valid Cross-site Scripting High 2018-03-30 – 9 Stored 'undefined' Cross-site Scripting #403793 Informative Cross-site Scripting Medium 2018-09-05 – 8 Khan Academy ClickJacking to Steal Users's Credintials #639682 Valid No weakness recorded – 2021-03-31 – 7 SignUp With Fake Email #403803 Informative Input Validation and Logic Medium 2018-09-05 – 7 XSS at http://smarthistory.khanacademy.org #6575 Valid Cross-site Scripting – 2014-04-09 – 7 Possible to join any class without coache's knowledge & Little Information Disclosure #266090 Valid Input Validation and Logic Medium 2017-10-12 – 6 The web app's forgot password page is vulnerable to text injection/content spoofing #159213 Valid Command and Code Injection – 2017-03-01 – 6 RTL override char allowed at khanacademy redirect page #641640 Informative Misconfiguration and Insecure Design Low 2019-08-02 – 5 No Security check at changing password and at adding mobile number which leads to account takeover and spam #207552 Informative Misconfiguration and Insecure Design Medium 2017-02-21 – 5 Html injection on khanacademy #83604 Valid Command and Code Injection – 2015-12-14 – 5 Open Redirection in SmartHistory KhanAcademy #6564 Valid Open Redirect – 2014-04-09 – 5 Persistent class XSS [the fuck] #6412 Valid Cross-site Scripting – 2014-04-09 – 5