The return of the ＜ Analysed #639684 Valid Cross-site Scripting High 2019-09-24 $1,000 576 Account Takeover using Linked Accounts due to lack of CSRF protection Analysed #463330 Valid Cross-Site Request Forgery High 2019-02-20 – 238 Stealing Facebook OAuth Code Through Screenshot viewer Analysed #488269 Valid Information Disclosure Medium 2019-03-05 – 200 XSS STORED AT socialclub.rockstargames.com (add friend request from profile attacker) Analysed #220852 Valid Cross-site Scripting Medium 2021-06-03 – 194 xss on https://www.rockstargames.com/GTAOnline/jp/screens/ Analysed #507494 Valid Cross-site Scripting Medium 2020-06-12 – 159 Access to the business emails of Rockstar Support agents through the support platform Analysed #1920908 Valid Access Control Low 2025-10-02 $550 151 Unserialize leading to arbitrary PHP function invoke Analysed #210741 Valid Command and Code Injection Critical 2017-12-13 – 119 Stored XSS in Snapmatic + R★Editor comments Analysed #309531 Valid Cross-site Scripting High 2018-04-19 – 118 SocialClub Account Take Over Through Import Friends feature Analysed #901728 Valid Cross-Site Request Forgery High 2021-04-01 – 116 Referer Leakage Vulnerability in socialclub.rockstargames.com/crew/ leads to FB'S OAuth token theft. Analysed #787160 Valid Cross-Site Request Forgery Medium 2020-06-24 – 112 CSRF Vulnerability on https://signin.rockstargames.com/tpa/facebook/link/ Analysed #474833 Valid Cross-Site Request Forgery Medium 2020-06-12 – 104 Password and mail address stored unencrypted in memory - Rockstar Game Launcher Analysed #1128357 Valid Cryptography Medium 2023-10-27 $750 91 Open redirect vulnerability Analysed #380760 Valid Open Redirect Low 2019-04-03 $250 83 Blind SSRF in emblem editor (2) Analysed #265050 Valid Server-Side Request Forgery Medium 2017-10-28 $1,500 83 LFI and SSRF via XXE in emblem editor Analysed #347139 Valid Injection and Smuggling Critical 2018-08-01 $1,500 79 Cache Poisoning DoS on updates.rockstargames.com Analysed #1219038 Valid Misconfiguration and Insecure Design Medium 2021-12-22 – 77 XSS on rockstargames.com Analysed #212700 Valid Cross-site Scripting High 2023-07-25 $500 75 Facebook OAuth Code Theft through referer leakage on support.rockstargames.com Analysed #482743 Valid Cross-Site Request Forgery Medium 2019-02-19 – 71 Insecure Direct Object Reference allows Crew Invite deletion Analysed #1947924 Valid Insecure Direct Object Reference Medium 2023-08-17 – 67 Ticket Trick Attack allows access to ████████' workspaces Analysed #1534465 Valid Access Control High 2026-09-01 – 66 Unquoted Service Path in "Rockstar Game Library Service" Analysed #716448 Valid Access Control Medium 2019-12-02 – 60 Brute Force against VMware Horizon Analysed #1278072 Valid Authentication Low 2021-08-16 $250 53 Social Club Account Takeover Via RGL And Steam/Epic Linked Account Analysed #1235008 Valid Access Control High 2021-11-17 – 53 SMB SSRF in emblem editor exposes taketwo domain credentials, may lead to RCE Analysed #288353 Valid Server-Side Request Forgery High 2018-01-12 $1,500 52 Improper Authentication inside the Rockstar Games Launcher which leads to Account takeover to some extend Analysed #1442783 Valid Authentication High 2023-07-05 $750 51 Bypass CAPTCHA protection Analysed #210417 Valid Authentication Medium 2018-04-23 – 51 Open Redirection effects autodiscover.rockstargames.com Analysed #1269332 Valid No weakness recorded Low 2025-02-03 – 49 Stored XSS on support.rockstargames.com Analysed #265384 Valid Cross-site Scripting Medium 2017-10-10 $1,000 49 full path disclosure on www.rockstargames.com via apache filename brute forcing Analysed #210238 Valid Information Disclosure Low 2019-10-04 – 48 DOM XSS on https://www.rockstargames.com/GTAOnline/feedback Analysed #803934 Valid Cross-site Scripting Medium 2020-06-11 – 46 DOM based XSS on /GTAOnline/tw/starterpack/ Analysed #508517 Valid Cross-site Scripting Medium 2020-06-24 – 46 Stored XSS in profile activity feed messages Analysed #231444 Valid Cross-site Scripting Medium 2017-08-28 $1,000 45 Exposed CDN access token allows modification of all newly uploaded Snapmatic photos Analysed #2184872 Valid Access Control Medium 2024-01-26 – 41 CSRF in 'set.php' via age causes stored XSS on 'get.php' - http://www.rockstargames.com/php/videoplayer_cache/get.php' Analysed #152013 Valid Cross-Site Request Forgery Medium 2017-03-10 – 40 Smuggle SocialClub's Facebook OAuth Code via Referer Leakage Analysed #342709 Valid Information Disclosure Medium 2018-10-23 $750 39 <- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information -> Analysed #204292 Valid Cross-Site Request Forgery Critical 2017-05-24 – 39 Image Injection vulnerability on screenshot-viewer/responsive/image may allow Facebook OAuth token theft. Analysed #655288 Valid Information Disclosure Medium 2020-06-24 – 36 Exploiting Misconfigured CORS to Steal User Information Analysed #317391 Valid Information Disclosure High 2018-10-17 $500 36 Stored XSS on profile page via Steam display name Analysed #282604 Valid Cross-site Scripting High 2017-11-10 $1,250 35 DOM Based xss on https://www.rockstargames.com/ ( 1 ) Analysed #475442 Valid Cross-site Scripting High 2020-06-12 – 34 stored XSS (angular injection) in support.rockstargames.com using zendesk register form via name parameter Analysed #354262 Valid Cross-site Scripting High 2018-11-06 $1,000 31 Stored XSS in snapmatic comments Analysed #231389 Valid Cross-site Scripting Medium 2017-09-05 $1,000 30 Image Injection/XSS vulnerability affecting https://www.rockstargames.com/newswire/article Analysed #790465 Valid Cross-Site Request Forgery Medium 2020-06-24 – 29 CSRF Vulnerability on post creation page /community/create-post.json Analysed #487378 Valid Cross-Site Request Forgery Low 2020-07-07 – 29 Uninstalling Rockstar Games Launcher for Windows (64-bit), then reinstalling keeps you logged in without authentication Analysed #1278261 Valid Information Disclosure Low 2022-04-07 $250 28 CSRF Vulnerability allows attackers to steal SocialClub private token. Analysed #253128 Valid Cross-Site Request Forgery High 2017-08-03 – 28 XSS in http://www.rockstargames.com/theballadofgaytony/js/jquery.base.js Analysed #242905 Valid Cross-site Scripting Medium 2017-07-17 – 28 DOM based reflected XSS in rockstargames.com/newswire/tags through cross domain ajax request Analysed #172843 Valid Cross-site Scripting Medium 2017-03-17 – 27 Reflected XSS in /Videos/ via calling a callback http://www.rockstargames.com/videos/#/?lb= Analysed #151276 Valid Cross-site Scripting Medium 2017-09-25 – 27 Reflected XSS via #tags= while using a callback in newswire http://www.rockstargames.com/newswire Analysed #153618 Valid Cross-site Scripting Medium 2017-03-16 – 26