Reflected XSS on www.hackerone.com and resources.hackerone.com Analysed #840759 Valid Cross-site Scripting Low 2020-05-05 $500 387 Getting New Invitations without Leaving Programs Analysed #999789 Valid Input Validation and Logic Low 2020-10-15 – 322 Cross-site Scripting (XSS) on HackerOne careers page Analysed #474656 Valid Cross-site Scripting Low 2019-02-17 $500 239 Reflected XSS on www.hackerone.com via Wistia embed code Analysed #986386 Valid Cross-site Scripting Low 2020-09-24 $500 236 Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve status Analysed #654198 Valid Information Disclosure Low 2019-09-29 $500 213 DOM Based XSS in www.hackerone.com via PostMessage Analysed #398054 Valid Cross-site Scripting Low 2019-02-21 $500 208 An invite-only's program submission state is accessible to users no longer part of the program Analysed #800109 Valid Information Disclosure Low 2020-04-21 $500 194 adding h1_analyst_* to username for normal users Analysed #1770797 Valid Input Validation and Logic Low 2023-04-12 $500 187 Account creation with invalid email addresses / email is accepting % and %0d%0a line termination chars Analysed #815085 Valid Misconfiguration and Insecure Design Low 2024-02-04 $3,750 176 404-response contains debug-information with all headers Analysed #792998 Valid Information Disclosure Low 2020-05-16 – 173 RXSS at image.hackerone.live via the `url` parameter Analysed #2035332 Valid Cross-site Scripting Low 2023-08-11 $500 171 Total Paid Bounty Paid can be disclose Analysed #674757 Valid Information Disclosure Low 2020-02-28 $500 168 Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpoint Analysed #536853 Valid Insecure Direct Object Reference Low 2019-04-23 – 161 Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com Analysed #381356 Valid Input Validation and Logic Low 2019-04-05 – 154 Hacker.One Subdomain Takeover Analysed #159156 Valid Misconfiguration and Insecure Design Low 2016-09-20 – 154 Race Condition leads to undeletable group member Analysed #604534 Valid Race Conditions Low 2020-03-20 – 153 [ Spot Check ] Team members can edit a user's write-up Analysed #2530242 Valid Access Control Low 2024-06-06 – 149 Blind SSRF on errors.hackerone.net due to Sentry misconfiguration Analysed #374737 Valid Server-Side Request Forgery Low 2018-07-04 $3,500 143 Subdomain takeover at info.hacker.one Analysed #202767 Valid Access Control Low 2017-03-27 – 134 Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse Analysed #3378540 Valid Access Control Low 2026-03-18 – 126 Account recovery text message is sending a wrong domain to users. Analysed #549364 Valid Input Validation and Logic Low 2019-05-31 – 117 HackerOne Code sends live password-reset tokens to Segment in automatic page events Analysed #4000185 Valid Authentication Low 2026-09-24 $200 115 Emails of invited collaborators are disclosed in full in payload for report participants Analysed #269230 Valid Information Disclosure Low 2019-04-09 – 112 [IDOR] Improper Access Control on Embedded Submission Form Analysed #2483666 Valid Insecure Direct Object Reference Low 2024-06-19 $2,500 110 Recently added 'Country' field doesn't send email notification when changed Analysed #961841 Valid Misconfiguration and Insecure Design Low 2020-08-25 – 108 DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054) Analysed #499030 Valid Cross-site Scripting Low 2019-05-04 – 106 [Bypass #645264] Report title disclosure despite the program settings for email notification is set to "No Content" Analysed #669438 Valid No weakness recorded Low 2019-09-09 $500 104 Attacker with an Old account might still be able to DoS ctf.hacker101.com by sending a Crafted request Analysed #861170 Valid Denial of Service Low 2020-05-25 – 97 Subdomain takeover of resources.hackerone.com Analysed #863551 Valid No weakness recorded Low 2020-05-15 $500 95 Password not checked when disabling 2FA on HackerOne Analysed #587910 Valid Misconfiguration and Insecure Design Low 2019-06-07 – 95 Race Condition in Flag Submission Analysed #454949 Valid Race Conditions Low 2019-07-22 – 94 Confirmed #2118458: Intentional redirect from www.hackerone.com to domain which is up for sale Analysed #2476149 Valid No weakness recorded Low 2024-05-09 – 91 "Bounties paid in the last 90 days" discloses the undisclosed bounty amount in program statistics Analysed #696266 Valid Information Disclosure Low 2020-02-21 $500 86 HTML Injection in email via Name field Analysed #1581499 Valid Cross-site Scripting Low 2022-09-18 $500 84 Login CSRF vulnerability on hackerone.com Analysed #834366 Valid Cross-Site Request Forgery Low 2020-06-12 $500 84 Program admins could add verified domains to an organization Analysed #2323303 Valid Access Control Low 2024-03-07 – 83 Denial Of Service (Out Of Memory) on Updating Bounty Table [Urgent] Analysed #1043372 Valid Denial of Service Low 2021-02-02 – 83 Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on Mobile Analysed #2553026 Valid Misconfiguration and Insecure Design Low 2025-03-13 – 82 Bypass of #2035332 RXSS at image.hackerone.live via the `url` parameter Analysed #2106708 Valid Cross-site Scripting Low 2023-08-22 – 80 latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users Analysed #724944 Valid Information Disclosure Low 2019-11-10 – 79 IDOR on HackerOne Feedback Review Analysed #262661 Valid Insecure Direct Object Reference Low 2017-09-02 – 79 Any one can view collaborater email address via path /reports/<id>/participants Analysed #1918362 Valid Access Control Low 2023-06-01 – 78 HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity Analysed #1826141 Valid Information Disclosure Low 2023-02-10 $500 78 Subdomain takeover #2 at info.hacker.one Analysed #209004 Valid Access Control Low 2017-04-28 – 78 Access to limited confidential information of private program as a Ex-reporter, Report Participant(external user) & Ex-staff member Analysed #2632876 Valid Access Control Low 2024-12-24 – 77 Usernames still visible on report export pdf despite "I want to redact all usernames" is selected Analysed #2054222 Valid Information Disclosure Low 2023-08-08 $500 75 Pentester can obtain information about other pentesters who applied for the same test, but weren't accepted Analysed #958374 Valid Information Disclosure Low 2020-08-24 $500 74 Race condition leads to duplicate payouts Analysed #220445 Valid Access Control Low 2017-05-23 – 73 Race condition in joining CTF group Analysed #1540969 Valid Race Conditions Low 2023-01-08 $500 72 Team object in GraphQL disclosed of private programs via the industry Analysed #707406 Valid No weakness recorded Low 2019-11-23 $500 72