Skip to content
Connect AISign inSign up free

Bug bounty reports15,219

Atlas

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Program:PayPal
Status:Valid
Clear
Severity
Weakness
Year
Bounty paid7
Access stated
  • No account0
  • A user account0
  • Admin or privileged0
Access needed
Technique
Clear filters13 of 15,219 reports
Disclosed bug bounty reports
ReportStatusWeaknessSeverityDisclosedBountyVotes
Bypass for #488147 enables stored XSS on https://paypal.com/signin againAnalysed#510152ValidInjection and SmugglingHigh2019-08-07$20,0002,687
Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordAnalysed#739737ValidAuthenticationHigh2020-01-08$15,3001,409
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#925585ValidCommand and Code InjectionCritical2021-02-09$30,000946
DoS on PayPal via web cache poisoningAnalysed#622122ValidDenial of ServiceMedium2019-10-23$9,700851
IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersAnalysed#415081ValidInsecure Direct Object ReferenceHigh2019-07-30$10,500797
Stored XSS on https://paypal.com/signin via cache poisoningAnalysed#488147ValidInjection and SmugglingHigh2019-08-07$18,900685
[PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443ValidOpen RedirectMedium2019-02-07–188
[Venmo Android] Remote theft of user sessionAnalysed#401940ValidOpen RedirectMedium2019-02-07–151
Reflected XSS at https://www.paypal.com/ppcreditapply/da/usAnalysed#753835ValidCross-site ScriptingMedium2020-05-19–137
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)Analysed#425200ValidCross-site ScriptingMedium2018-11-06–100
Unsafe deserialization leads to token leakage in PayPal & PayPal for Business [Android]Analysed#453791ValidDeserialization and Object InjectionMedium2021-04-30–93
XSSI on refer.xoom.com allows stealing email addresses and posting to Twitter on behalf of victimAnalysed#450796ValidCross-Site Request ForgeryMedium2019-02-07$3,50081
Reflect XSS and CSP Bypass on https://www.paypal.com/businesswallet/currencyConverter/Analysed#799881ValidCross-site ScriptingMedium2021-02-10–54

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,190 analysed so far), which can be wrong. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated