Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.comAnalysed#1046630	Valid	Cross-Site Request Forgery	Medium	2021-01-06	–	99
Manipulating response leads to free access to Streamlabs PrimeAnalysed#1070510	Valid	Input Validation and Logic	Medium	2021-01-21	–	80
session takeover via open protocol redirection on streamlabs.comAnalysed#1178239	Valid	Open Redirect	Medium	2021-09-01	$200	50
SSRF allows reading AWS EC2 metadata using "readapi" variable in Streamlabs CloudbotAnalysed#1108418	Valid	Server-Side Request Forgery	Medium	2021-02-24	$200	41
Privilege Escalation Leads to Control The Owner Access Token Which leads to control the stream [streamlabs.com]Analysed#1174527	Valid	Access Control	Low	2021-04-27	–	38
Host Header injection in oslo.io (using X-Forwarded-For header) leading to email spoofingAnalysed#1072277	Valid	Input Validation and Logic	High	2021-01-07	–	37
Sensitive information disclosure to shared access user via streamlabs platform apiAnalysed#1072893	Valid	Information Disclosure	Medium	2021-01-20	$200	36
Steal any users `access_token` via open redirect in https://streamlabs.com/global/identity?popup=1&r=Analysed#1327742	Valid	No weakness recorded	Medium	2021-11-04	–	27
Stored XSS on oslo.io in notifications via project name changeAnalysed#1070859	Valid	Cross-site Scripting	Medium	2021-01-05	–	26
Moderator user has access to owner's support portal and ticketsAnalysed#1071918	Valid	Access Control	Medium	2021-01-20	$200	19
clickjacking on deleting user's clips [https://crossclip.com/clips]#1294767	Valid	Misconfiguration and Insecure Design	Low	2021-11-05	–	4

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.