Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
PIN bypass in PassCodeActivity via back buttonAnalysed#3625210	Valid	Authentication	Medium	2026-06-07	$150	101
Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId)Analysed#3572848	Valid	Access Control	Medium	2026-05-21	$150	100
Calendar app allowed booking appointments without the generated tokenAnalysed#3275810	Valid	Insecure Direct Object Reference	Low	2025-12-05	–	57
Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDCAnalysed#3489490	Valid	Authentication	High	2026-06-07	$2,500	55
Authentication bypass in Global Site Selector allows an attacker to log in as any userAnalysed#2248689	Valid	No weakness recorded	Critical	2024-01-18	–	50
App PIN code can be bypassed in Files iOSAnalysed#2245437	Valid	Authentication	Low	2023-12-18	$100	33
Bruteforce protection in password verification can be bypassedAnalysed#2230915	Valid	Authentication	Medium	2024-01-17	–	31
Passcode bypass on Talk Android appAnalysed#1784645	Valid	Access Control	Low	2023-01-09	–	30
Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlistAnalysed#2251074	Valid	Injection and Smuggling	Medium	2024-01-18	–	22
Full Passcode bypass on Nextcloud App iOSAnalysed#1847368	Valid	Access Control	Low	2023-04-10	–	21
bypass of 2FAAnalysed#248656	Valid	Authentication	High	2018-07-29	$750	20
Authentication IssueAnalysed#146133	Valid	Authentication	–	2018-10-25	$50	19
App pin of the Android app can be bypassed via 3rdparty apps generating deep linksAnalysed#1825679	Valid	Authentication	Low	2023-05-04	–	18
Activity app does not verify federated file activity received from remote serversAnalysed#3534050	Valid	Authentication	Low	2026-09-05	$150	16

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.