profile-picture name parameter with large value lead to DoS for other users and programs on the platform Analysed #764434 Valid Denial of Service Medium 2020-03-25 – 475 Hackerone is not properly deleting user id Analysed #1133118 Valid Input Validation and Logic Medium 2021-06-11 – 356 Information Disclosure in /skills call Analysed #188719 Valid Information Disclosure Medium 2017-01-05 $10,000 287 Team member with Program permission only can escalate to Admin permission Analysed #605720 Valid Access Control Medium 2019-06-26 – 268 Denial of service via cache poisoning Analysed #409370 Valid Denial of Service Medium 2018-12-22 $2,500 253 Race condition in performing retest allows duplicated payments Analysed #429026 Valid Race Conditions Medium 2018-12-27 – 240 Static files on HackerOne.com can be made inaccessible through Cache Poisoning attack Analysed #1181946 Valid Denial of Service Medium 2021-12-22 – 228 Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information Analysed #2937622 Valid Information Disclosure Medium 2025-05-31 – 226 Google Docs link in JS files allows editing & reading survey information Analysed #2180521 Valid Information Disclosure Medium 2023-11-04 – 217 HackerOne Jira integration plugin Leaked JWT to unauthorized jira users Analysed #1103582 Valid Authentication Medium 2021-04-01 $3,000 213 IDOR vulnerability in unreleased HackerOne Copilot feature Analysed #2218334 Valid Insecure Direct Object Reference Medium 2023-10-25 – 210 Uploading large payload on domain instructions causes server-side DoS Analysed #887321 Valid Denial of Service Medium 2020-06-20 $2,500 210 Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form Analysed #418767 Valid Access Control Medium 2018-10-31 $10,000 208 Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photos Analysed #1034257 Valid Misconfiguration and Insecure Design Medium 2021-03-25 – 194 Unauthorized access to metadata of undisclosed reports that were retested Analysed #871749 Valid Information Disclosure Medium 2020-06-05 – 189 IDOR Vulnerability at AddTagToAssets operation name Analysed #2633771 Valid Insecure Direct Object Reference Medium 2025-06-08 – 178 Disclosure of `payment_transactions` for programs via GraphQL query Analysed #707433 Valid Information Disclosure Medium 2019-12-01 – 178 LLM01: Invisible Prompt Injection Analysed #2372363 Valid Injection and Smuggling Medium 2024-05-13 – 159 IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifier Analysed #449351 Valid Cross-site Scripting Medium 2018-11-27 $2,500 156 Hackerone supports accounts organitation takeover Analysed #2798380 Valid No weakness recorded Medium 2024-11-19 $2,500 155 Banned user still has access to their deleted account via HackerOne's API using their API key Analysed #1577940 Valid Access Control Medium 2025-07-14 – 150 Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report Analysed #410015 Valid Information Disclosure Medium 2019-04-24 $3,000 147 Stored XSS in IE11 on hackerone.com via custom fields Analysed #1173040 Valid Cross-site Scripting Medium 2021-06-24 – 146 Team object in GraphQL disclosed private_comment Analysed #978143 Valid Information Disclosure Medium 2020-09-10 $2,500 146 h1-202 leaderboard photo discloses local wifi password Analysed #329798 Valid Authentication Medium 2018-03-25 – 145 Unauthorized user can obtain `report_sources` attribute through Team GraphQL object Analysed #770209 Valid Information Disclosure Medium 2020-02-10 $2,500 142 Server Side Request Forgery (SSRF) in webhook functionality Analysed #2301565 Valid Server-Side Request Forgery Medium 2024-01-30 $2,500 140 Disclose any user's private email through API Analysed #196655 Valid Information Disclosure Medium 2017-02-24 – 140 Bypassing HackerOne 2FA due to race condition Analysed #2598548 Valid Input Validation and Logic Medium 2024-10-30 – 139 Payload delivery via Social Media urls on H1 profile Analysed #2483422 Valid File and Path Handling Medium 2024-07-23 – 138 Takeover of hackerone.engineering via Github Analysed #2085260 Valid Access Control Medium 2023-07-31 – 135 Disclosure handle private program with external link Analysed #1276992 Valid No weakness recorded Medium 2021-08-24 $2,500 130 Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.com Analysed #374919 Valid Cross-site Scripting Medium 2018-08-04 – 129 Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible Analysed #685909 Valid Information Disclosure Medium 2019-11-08 – 127 Ability to access policy and updates for unauthorized program Analysed #2965723 Valid Access Control Medium 2025-05-08 – 124 Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widget Analysed #1598347 Valid Cross-site Scripting Medium 2023-03-10 – 122 Leaked H1's Employees Email addresses,meeting info on private bug bounty program ████████ Analysed #1285115 Valid Information Disclosure Medium 2021-11-08 – 118 @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant. Analysed #397792 Valid Input Validation and Logic Medium 2019-01-02 – 117 Ability to identify actual private from sandboxed programs using link hackerone.com/$handle/terms_acceptance_data.csv Analysed #2381253 Valid Access Control Medium 2024-06-20 $500 111 ActiveStorage throws exception when using whitespace as filename, may lead to denial of service of multiple pages Analysed #713407 Valid Denial of Service Medium 2019-12-13 – 111 Banned user still able to invited to reports as a collabrator and reset the password Analysed #1959219 Valid Access Control Medium 2023-07-06 – 107 GraphQL field on Team node can be used to determine if External Program runs invite-only program Analysed #877642 Valid Information Disclosure Medium 2020-07-25 $2,500 107 Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature Analysed #334205 Valid Input Validation and Logic Medium 2018-04-18 $2,500 103 New Hacktivity features:Bounty rewards leakage Where programs doesn’t decide to disclose bounty in limited disclosure report Analysed #2310620 Valid Information Disclosure Medium 2024-03-28 – 97 An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed Analysed #2040756 Valid Access Control Medium 2024-01-04 – 93 Team object in GraphQL disclosed total number of whitelisted hackers Analysed #342978 Valid Information Disclosure Medium 2018-05-12 $2,500 93 Reading redacted data via hackbot's answers Analysed #247628 Valid Information Disclosure Medium 2017-07-27 $1,500 93 Bypass report submit restriction/ban using the API key Analysed #2081930 Valid Access Control Medium 2023-10-29 – 91 A user can bypass approval step in Hacker Publishing feature, allowing them to publish reports immediately Analysed #452959 Valid Access Control Medium 2018-12-05 $2,500 90 Able to Create Testimonials for myself using Sandbox Analysed #2490953 Valid Access Control Medium 2024-05-22 – 86