Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
11 of 15,219 reports · 227 analysed so far
- #1842674ValidSQL Injection + Insecure Deserialization leads to Remote Code Execution on https://krisp.aiKrisp · Deserialization and Object Injection · 2023–119votes
- #1608151ValidAuthentication bypass for ███ leads to take over any users account.Krisp · Authentication · 2022–48votes
- #1267476ValidAuthentication CSRF resulting in unauthorized account access on Krisp appKrisp · Authentication · 2022–35votes
- #1446090ValidAdd more seats by paying less via PUT /v2/seats request manipulationKrisp · Input Validation and Logic · 2022–30votes
- #1418419Valid[api.krisp.ai] Race condition on /v2/seats endpoint allows bypassing the original seat limitKrisp · Race Conditions · 2022–26votes
- #1670304ValidCard requirement bypass for business trialKrisp · Access Control · 2022–22votes
- #1431624InformativeLog4j CVE-2021–44228Krisp · Command and Code Injection · 2021–21votes
- #1450014DuplicateVisibility Robots.txt fileKrisp · Information Disclosure · 2022–19votes
- #1420070ValidForce User to Accept Attacker's invite [ Restrict user to create account]Krisp · Access Control · 2022–10votes
- #1444031InformativeError Page Content Spoofing or Text InjectionKrisp · Misconfiguration and Insecure Design · 2022–8votes
- #1439025DuplicateUnsubscripe linkes leakedKrisp · No weakness recorded · 2022–3votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.