Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
DoS on PayPal via web cache poisoningAnalysed#622122	Valid	Denial of Service	Medium	2019-10-23	$9,700	851
[PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443	Valid	Open Redirect	Medium	2019-02-07	–	188
[Venmo Android] Remote theft of user sessionAnalysed#401940	Valid	Open Redirect	Medium	2019-02-07	–	151
Reflected XSS at https://www.paypal.com/ppcreditapply/da/usAnalysed#753835	Valid	Cross-site Scripting	Medium	2020-05-19	–	137
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)Analysed#425200	Valid	Cross-site Scripting	Medium	2018-11-06	–	100
Unsafe deserialization leads to token leakage in PayPal & PayPal for Business [Android]Analysed#453791	Valid	Deserialization and Object Injection	Medium	2021-04-30	–	93
XSSI on refer.xoom.com allows stealing email addresses and posting to Twitter on behalf of victimAnalysed#450796	Valid	Cross-Site Request Forgery	Medium	2019-02-07	$3,500	81
Reflect XSS and CSP Bypass on https://www.paypal.com/businesswallet/currencyConverter/Analysed#799881	Valid	Cross-site Scripting	Medium	2021-02-10	–	54

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.