Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.comAnalysed#1046630	Valid	Cross-Site Request Forgery	Medium	2021-01-06	–	99
Manipulating response leads to free access to Streamlabs PrimeAnalysed#1070510	Valid	Input Validation and Logic	Medium	2021-01-21	–	80
session takeover via open protocol redirection on streamlabs.comAnalysed#1178239	Valid	Open Redirect	Medium	2021-09-01	$200	50
CSRF in changing users donation_settings [https://streamlabs.com/api/v6/viewer-portal/viewer-settings/donation_settings]Analysed#1049360	Valid	Cross-Site Request Forgery	Medium	2020-12-26	–	49
SSRF allows reading AWS EC2 metadata using "readapi" variable in Streamlabs CloudbotAnalysed#1108418	Valid	Server-Side Request Forgery	Medium	2021-02-24	$200	41
Sensitive information disclosure to shared access user via streamlabs platform apiAnalysed#1072893	Valid	Information Disclosure	Medium	2021-01-20	$200	36
Steal any users `access_token` via open redirect in https://streamlabs.com/global/identity?popup=1&r=Analysed#1327742	Valid	No weakness recorded	Medium	2021-11-04	–	27
Stored XSS on oslo.io in notifications via project name changeAnalysed#1070859	Valid	Cross-site Scripting	Medium	2021-01-05	–	26
Moderator user has access to owner's support portal and ticketsAnalysed#1071918	Valid	Access Control	Medium	2021-01-20	$200	19

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.