Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Reset any passwordAnalysed#703972 | Valid | Authentication | – | 2021-03-31 | – | 313 |
| Stealing Users OAuth authorization code via redirect_uriAnalysed#1861974 | Valid | Access Control | – | 2023-03-22 | $2,000 | 253 |
| Disclose Hidden Comments on Media Section of hub.vroid.com#2541962 | Valid | Insecure Direct Object Reference | Medium | 2026-01-18 | $500 | 149 |
| Internal logs/info leaked via endpoint {https://203.137.128.240/server-status}#2473173 | Valid | Information Disclosure | High | 2026-01-20 | – | 145 |
| XSS reflected on [https://www.pixiv.net]#766633 | Valid | Cross-site Scripting | – | 2020-12-17 | $500 | 144 |
| Non-premium user can disable Ads in japanese version of dic.pixiv.net#3183520 | Valid | Input Validation and Logic | High | 2026-04-27 | $3,000 | 123 |
| clickjacing can lead to account takeover#2119892 | Valid | Misconfiguration and Insecure Design | Low | 2026-01-18 | $200 | 70 |
| XSS Reflected at https://sketch.pixiv.net/ Via `next_url`#1503601 | Valid | Cross-site Scripting | – | 2022-03-23 | – | 64 |
| Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.net#3100570 | Valid | Access Control | Low | 2026-04-27 | – | 53 |
| RCE due to ImageTragick v2#402362 | Valid | Command and Code Injection | – | 2021-03-16 | $2,000 | 44 |
| Open redirect protection (https://www.pixiv.net/jump.php) is broken for novels#541862 | Valid | Open Redirect | – | 2019-10-01 | $200 | 42 |
| CSRF at https://chatstory.pixiv.net/imported#534908 | Valid | Cross-Site Request Forgery | – | 2020-07-02 | $500 | 31 |
| Bypass extension check leads to stored XSS at https://s2.booth.pm#1019425 | Valid | Cross-site Scripting | – | 2021-01-08 | – | 30 |
| Open Redirect at https://oauth.secure.pixiv.net#972601 | Valid | Open Redirect | – | 2020-12-22 | $200 | 29 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.