Account takeover via leaked session cookie Analysed #745324 Valid Authentication High 2019-12-03 $20,000 1,642 Email address of any user can be queried on Report Invitation GraphQL type when username is known Analysed #792927 Valid Access Control High 2020-02-20 – 671 Customer private program can disclose email any users through invited via username Analysed #807448 Valid Information Disclosure High 2020-05-15 $7,500 589 An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name Analysed #2032716 Valid Information Disclosure High 2023-07-04 $12,500 429 IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL query Analysed #2122671 Valid Insecure Direct Object Reference High 2023-08-29 – 395 Partial disclosure of report activity through new "Export as .zip" feature Analysed #182358 Valid Information Disclosure High 2016-11-29 $10,000 355 Insecure Direct Object Reference (IDOR) - Delete Campaigns Analysed #1969141 Valid Insecure Direct Object Reference High 2023-05-03 – 346 An attacker can archive and unarchive any structured scope object on HackerOne Analysed #1501611 Valid No weakness recorded High 2022-04-18 – 318 Internal attachments can be exported via "Export as .zip" feature Analysed #186230 Valid Information Disclosure High 2016-11-30 $12,500 269 View Titles of Private Reports with pending email invitation Analysed #2312029 Valid Access Control High 2024-01-16 – 257 Account takeover of existing HackerOne accounts through SCIM provisioning Analysed #3178999 Valid Access Control High 2025-07-17 – 232 HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organization Analysed #2101076 Valid Memory Corruption High 2024-02-04 – 228 Internal Access to Hackerone confluence Docs Analysed #3113398 Valid Misconfiguration and Insecure Design High 2025-08-15 $12,500 227 Markdown parsing issue enables insertion of malicious tags and event handlers Analysed #299728 Valid Cross-site Scripting High 2018-01-29 $5,000 184 Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql Analysed #3694007 Valid Command and Code Injection High 2026-06-17 $7,000 174 Improper CSRF token validation allows attackers to access victim's accounts linked to Hackerone Analysed #1727221 Valid Cross-Site Request Forgery High 2023-06-19 – 168 Slack integration setup lacks CSRF protection Analysed #170552 Valid Cross-Site Request Forgery High 2021-07-07 $2,500 149 Any user could upload attachments to pentest scoping form they don't have access to Analysed #2450215 Valid Input Validation and Logic High 2024-05-15 – 121 Internal Gitlab Ticket Disclosure via External Slack Channels Analysed #1273292 Valid Information Disclosure High 2021-08-04 – 118 Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports Analysed #2516250 Valid Access Control High 2024-06-17 – 109 Program Member Could Duplicate Report To A Non Related Program Original Report Analysed #2513082 Valid Access Control High 2024-06-19 – 104 Blind XSS in app.pullrequest.com/████████ via /reviews/ratings/{uuid} Analysed #1558010 Valid Cross-site Scripting High 2022-05-25 – 102 `exportReportPdf` mutation shows internal Activity Analysed #3577216 Valid No weakness recorded High 2026-07-29 – 92 Security@ email forwarding and Embedded Submission drafts can be used to obtain copy of deleted attachments from other HackerOne users Analysed #1034346 Valid Insecure Direct Object Reference High 2020-11-17 – 91 SQL Injection in CVE Discovery Search Analysed #1893800 Valid SQL Injection High 2023-03-06 – 87 Unauthenticated user can upload an attachment to the last updated report draft Analysed #419896 Valid Memory Corruption High 2018-10-09 – 87 Improper UUID validation results in bypass of #419896 Analysed #423073 Valid Input Validation and Logic High 2018-10-25 – 82 Any organization's assets pending review can be downloaded Analysed #1787644 Valid Information Disclosure High 2022-11-29 – 76 Non Org Admin/Group Manager can create groups in an organization Analysed #2372018 Valid Access Control High 2024-07-23 – 68 Embedded submission form UUIDs can be enumerated through GraphQL node interface, exposing sensitive program details Analysed #447930 Valid Insecure Direct Object Reference High 2019-01-11 – 54 Business Logic error leads to bypass 2FA requirement #2571981 Duplicate Input Validation and Logic High 2024-07-11 – 39 Private program email forwarding response invitation not expire after first use. Analysed #209140 Valid Misconfiguration and Insecure Design High 2018-05-30 – 38 Two-factor authentication bypass lead to information disclosure about the program and all hackers participate #2486086 Duplicate Information Disclosure High 2024-07-11 – 37 Improper Authentication - 2FA OTP Reusable #2529780 Duplicate Authentication High 2024-07-11 – 31 HackerOne Pentesters can access any structured scope object through GraphQL node interface #781150 Valid Access Control High 2020-03-11 – 30 Ability to escape database transaction through SQL injection, leading to arbitrary code execution #1663299 Valid SQL Injection High 2022-08-09 – 29 Improperly validated fields allows injection of arbitrary HTML via spoofed React objects #49652 Valid Cross-site Scripting High 2015-03-18 $5,000 23 Vulnerability with the way \ escaped characters in <http://danlec.com> style links are rendered #46072 Valid Cross-site Scripting High 2015-02-03 $5,000 21 TOTP Authenticator implementation Accepts Expired Codes #2588810 Informative Authentication High 2024-07-11 – 19 Markdown parsing issue enables insertion of malicious tags and event handlers #46916 Valid Cross-site Scripting High 2015-04-07 $5,000 16