Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
13 of 15,219 reports · $107,900 in bounties · 227 analysed so far
- #510152ValidAnalysedBypass for #488147 enables stored XSS on https://paypal.com/signin againPayPal · Injection and Smuggling · 2019 · needs: no account · Request smuggling, Cache poisoning$20,0002,687votes
- #739737ValidAnalysedToken leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordPayPal · Authentication · 2020 · needs: no account · Information disclosure, Authentication bypass$15,3001,409votes
- #925585ValidAnalysedRCE via npm misconfig -- installing internal libraries from the public registryPayPal · Command and Code Injection · 2021 · needs: no account · Dependency confusion / supply chain$30,000946votes
- #622122ValidAnalysedDoS on PayPal via web cache poisoningPayPal · Denial of Service · 2019 · needs: no account · Cache poisoning, Denial of service, Request smuggling$9,700851votes
- #415081ValidAnalysedIDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersPayPal · Insecure Direct Object Reference · 2019 · needs: a user account · IDOR / object reference, Missing authorisation check$10,500797votes
- #488147ValidAnalysedStored XSS on https://paypal.com/signin via cache poisoningPayPal · Injection and Smuggling · 2019 · needs: no account · Request smuggling, Cache poisoning$18,900685votes
- #424443Valid[PayPal Android] Remote theft of user session using push_notification_webview deeplinkPayPal · Open Redirect · 2019–188votes
- #401940Valid[Venmo Android] Remote theft of user sessionPayPal · Open Redirect · 2019–151votes
- #753835ValidReflected XSS at https://www.paypal.com/ppcreditapply/da/usPayPal · Cross-site Scripting · 2020–137votes
- #425200ValidXSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)PayPal · Cross-site Scripting · 2018–100votes
- #453791ValidUnsafe deserialization leads to token leakage in PayPal & PayPal for Business [Android]PayPal · Deserialization and Object Injection · 2021–93votes
- #450796ValidXSSI on refer.xoom.com allows stealing email addresses and posting to Twitter on behalf of victimPayPal · Cross-Site Request Forgery · 2019$3,50081votes
- #799881ValidReflect XSS and CSP Bypass on https://www.paypal.com/businesswallet/currencyConverter/PayPal · Cross-site Scripting · 2021–54votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.