Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
15 of 15,219 reports · $900 in bounties · 227 analysed so far
- #1046630ValidOne Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.comLogitech · Cross-Site Request Forgery · 2021–99votes
- #1070510ValidManipulating response leads to free access to Streamlabs PrimeLogitech · Input Validation and Logic · 2021–80votes
- #1049012ValidStored XSS in [https://streamlabs.com/dashboard#/*goal] pagesLogitech · Cross-site Scripting · 2020–68votes
- #983070ValidIDOR when creating App on [platform.streamlabs.com/api/v1/store/whitelist] with user_id fieldLogitech · Insecure Direct Object Reference · 2020–61votes
- #1178239Validsession takeover via open protocol redirection on streamlabs.comLogitech · Open Redirect · 2021$20050votes
- #1049360ValidCSRF in changing users donation_settings [https://streamlabs.com/api/v6/viewer-portal/viewer-settings/donation_settings]Logitech · Cross-Site Request Forgery · 2020–49votes
- #1108418ValidSSRF allows reading AWS EC2 metadata using "readapi" variable in Streamlabs CloudbotLogitech · Server-Side Request Forgery · 2021$20041votes
- #1174527ValidPrivilege Escalation Leads to Control The Owner Access Token Which leads to control the stream [streamlabs.com]Logitech · Access Control · 2021–38votes
- #1072277ValidHost Header injection in oslo.io (using X-Forwarded-For header) leading to email spoofingLogitech · Input Validation and Logic · 2021–37votes
- #1072893ValidSensitive information disclosure to shared access user via streamlabs platform apiLogitech · Information Disclosure · 2021$20036votes
- #978680ValidGET based Open redirect on [streamlabs.com/content-hub/streamlabs-obs/search?query=]Logitech · Open Redirect · 2020$10034votes
- #1327742ValidSteal any users `access_token` via open redirect in https://streamlabs.com/global/identity?popup=1&r=Logitech · No weakness recorded · 2021–27votes
- #1070859ValidStored XSS on oslo.io in notifications via project name changeLogitech · Cross-site Scripting · 2021–26votes
- #1071918ValidModerator user has access to owner's support portal and ticketsLogitech · Access Control · 2021$20019votes
- #1294767Validclickjacking on deleting user's clips [https://crossclip.com/clips]Logitech · Misconfiguration and Insecure Design · 2021–4votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.