Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| SSL certificate not validated when registering with a providerAnalysed#903424 | Valid | Cryptography | Medium | 2021-06-02 | $300 | 43 |
| Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.comAnalysed#2446531 | Valid | Cryptography | Medium | 2024-05-22 | – | 37 |
| OAuth2 client_secret stored in plain text in the databaseAnalysed#1994324 | Valid | Cryptography | Medium | 2023-11-15 | $100 | 31 |
| X-E2EE-SIGNATURE verification can be bypassed, leading to loss of confidentiality of end-to-end encrypted filesAnalysed#2597504 | Valid | Cryptography | Medium | 2024-12-15 | – | 27 |
| Predictable proposal participant tokens enable unauthorized access and vote submissionAnalysed#3385434 | Valid | Cryptography | Low | 2026-01-04 | $100 | 25 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.