Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| TLS certificate hostname bypass when the IP is written fullwidth digitsAnalysed#4038287 | Valid | Cryptography | High | 2026-10-23 | – | 29 |
| Node.js: TLS session reuse can lead to hostname verification bypassAnalysed#811502 | Valid | Cryptography | High | 2020-06-03 | – | 29 |
| TLS certificate hostname bypass when the host loosely resolves to an IP addressAnalysed#4006744 | Valid | Cryptography | High | 2026-10-23 | – | 24 |
| HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificatesAnalysed#3816840 | Valid | Authentication | Medium | 2026-07-29 | – | 24 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.