Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessAny class
- Any class
- Cross-site Scripting10
- Cross-Site Request Forgery1
- Open Redirect4
- Server-Side Request Forgery1
- File and Path Handling1
- Memory Corruption1
- Race Conditions1
- Denial of Service4
- Input Validation and Logic8
- Misconfiguration and Insecure Design1
- Cryptography1
- Information Disclosure4
- Authentication10
- Access Control13
- Insecure Direct Object Reference6
- No weakness recorded6
Access (title)Any
Access (analysis)Any
TechniqueAny
72 of 15,219 reports · $50,700 in bounties · 161 analysed so far
- #1567186ValidAnalysedOne-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comReddit · Access Control · 2022 · needs: no account · OAuth state or flow flaw, OAuth redirect_uri abuse, Account takeover chain–509votes
- #1962645ValidAnalysed[accounts.reddit.com] Redirect parameter allows for XSSReddit · Cross-site Scripting · 2023 · needs: no account · Reflected XSS, Open redirect$5,000394votes
- #1960765ValidAnalysedBlind SSRF to internal services in matrix preview_link APIReddit · Server-Side Request Forgery · 2023 · needs: no account · SSRF, SSRF through a redirect, Information disclosure$6,000344votes
- #2967634ValidAnalysedExposed proxy allows to access internal reddit domainsReddit · Access Control · 2025 · High · needs: no account · SSRF, Missing authorisation check$7,500296votes
- #1930763ValidRichText parser vulnerability in scheduled posts allows XSSReddit · Cross-site Scripting · 2023$5,000280votes
- #1213237ValidDeleting all DMs on RedditGifts.comReddit · Insecure Direct Object Reference · 2021$5,000267votes
- #2353237DuplicateInfromation Disclosure To Use of Hard-coded Cryptographic KeyReddit · Cryptography · 2024–238votes
- #1504410ValidXSS via Mod Log Removed PostsReddit · Cross-site Scripting · 2022–218votes
- #1661113ValidIDOR allows an attacker to modify the links of any userReddit · Insecure Direct Object Reference · 2022–208votes
- #1551176ValidAble to bypass email verification and change email to any other user emailReddit · Access Control · 2022$5,000200votes
- #1543159ValidAble to approve admin approval and change effective status without adding payment details .Reddit · Input Validation and Logic · 2022$5,000191votes
- #1596663ValidAdmin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.Reddit · Access Control · 2022 · admin or privileged (title)–186votes
- #1549206ValidReflected xss in https://sh.reddit.comReddit · Cross-site Scripting · 2022$5,000166votes
- #1658418ValidGetting access of mod logs from any public or restricted subreddit with IDOR vulnerabilityReddit · Insecure Direct Object Reference · 2022$5,000163votes
- #1051373ValidXSS Reflected on reddit.com via url pathReddit · Cross-site Scripting · 2022–157votes
- #1962951ValidRegression on dest parameter sanitization doesn't check scheme/websafe destinationsReddit · Cross-site Scripting · 2023$500101votes
- #1285598Valids3 bucket takeover presented in https://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/full-build-macos.shReddit · Input Validation and Logic · 2021–96votes
- #1656380ValidReddit talk promotion offers don't expire, allowing users to accept them after being demotedReddit · Insecure Direct Object Reference · 2022–72votes
- #1069039ValidGPS metadata preserved when converting HEIF to PNGReddit · Information Disclosure · 2021–67votes
- #996041ValidImage queue default key of 'None' and GraphQL unhandled type exceptionReddit · Memory Corruption · 2021$50065votes
- #1298902ValidOutsider can affect Upvote Percentage of private subreddit post by calling /api/vote APIReddit · Access Control · 2021–52votes
- #2618486InformativeIDOR lets a malicious user reveal the unpinned achievement badges of any Reddit userReddit · Insecure Direct Object Reference · 2024 · Low–47votes
- #1480569ValidCSRF (protection bypassed) to force a below 18 user into viewing an nsfw subreddit !Reddit · Cross-Site Request Forgery · 2022–47votes
- #1341957ValidHash-Collision Denial-of-Service Vulnerability in Markdown ParserReddit · Denial of Service · 2021–44votes
- #1213765ValidIDOR to pay less for coin purchases on oauth.reddit.com via /api/v2/gold/paypal/create_coin_purchase_order in `order_id` parameterReddit · Input Validation and Logic · 2021$50042votes
- #801743ValidRace condition leads to Inflation of coins when bought via Google Play Store at endpoint https://oauth.reddit.com/api/v2/gold/android/verify_purchaseReddit · Race Conditions · 2021–42votes
- #1257753ValidOpen Redirect on www.redditinc.com via `failed` query paramReddit · Open Redirect · 2022–41votes
- #1065186ValidWeak rate limit could lead to ATO due to weak password protection mechanismsReddit · Authentication · 2021–39votes
- #1606957ValidUnrestricted File Upload on reddit.secure.force.comReddit · No weakness recorded · 2022$10034votes
- #1237428Valid[dubsmash] Long String in 'shoutout' Parameter Leading Internal server Error on Popular hastags , Community and User ProfileReddit · Denial of Service · 2021–33votes
- #1122177ValidThird party app could steal access token as well as protected files using inAppBrowserReddit · Information Disclosure · 2021–32votes
- #1202408ValidNo Rate Limit on redditgifts gift when Adding CommentReddit · Misconfiguration and Insecure Design · 2021–25votes
- #1285081ValidOpen Redirect on www.redditinc.com via `failed` query param bypass after fixed bug #1257753Reddit · Open Redirect · 2022–21votes
- #1212374DuplicateOauth Misconfiguration Lead To Account TakeoverReddit · Access Control · 2021–21votes
- #1102365Valid[dubmash] Lack of authorization checks - Update Sound TitlesReddit · Access Control · 2021–21votes
- #1632186InformativeCan use the Reddit android app as usual even though revoking the access of it from reddit.comReddit · Authentication · 2022–20votes
- #1226891ValidDomain Takeover of Reddit.ru via DNS HijackingReddit · Access Control · 2021$50020votes
- #1582778InformativeMisconfigurated login page able to lock login action for any account without user interactionReddit · No weakness recorded · 2022–19votes
- #1543770ValidModerators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations`Reddit · Input Validation and Logic · 2022$10019votes
- #1165225Valid[dubsmash] Username and password bruteforceReddit · Authentication · 2021–18votes
- #1762927Informativeapi keys leakedReddit · Access Control · 2022–16votes
- #1744264N/Aread and message other user's messagesReddit · Insecure Direct Object Reference · 2023–14votes
- #1170522DuplicateMissing rate limit in current password change settings leads to Account takeoverReddit · Authentication · 2021–13votes
- #1815463Informativeoauth misconfigration lead to account takeoverReddit · Access Control · 2023–11votes
- #1719588InformativeHTML injection in API response including request urlReddit · File and Path Handling · 2023–11votes
- #1206004DuplicateNo rate limit leads to spaming postReddit · Authentication · 2023–11votes
- #1168804InformativeApplication level DOS at Login Page ( Accepts Long Password )Reddit · No weakness recorded · 2022–11votes
- #785833Informativeregistering with the same email address multiple times leads to account takeoverReddit · Authentication · 2022–11votes
- #1310230InformativeOpen Redirect through POST Request in www.redditinc.comReddit · Open Redirect · 2022–10votes
- #1209098N/AXSSReddit · Cross-site Scripting · 2021–10votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.