Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
How the Bug stole hackingAnalysed#762510	Valid	Insecure Direct Object Reference	None	2019-12-20	–	471
HackerOne making payments in USDC (Coinbase stable coin)Analysed#1220747	Valid	No weakness recorded	None	2021-06-17	–	201
Private program disclosure via `vpn_suspended` GraphQL queryAnalysed#715192	Valid	Information Disclosure	None	2019-10-21	$2,500	138
How the Arch Angel stole Live EventsAnalysed#2285198	Valid	No weakness recorded	None	2023-12-15	–	98
Cloud Computer Hackerone Triager can be Accessible for everyone [h1_analyst_lucas+view@wearehackerone.com] computer#2263294	Informative	Input Validation and Logic	None	2024-05-10	–	91
Blind Stored XSS in HackerOne's Sal 4.1.4.2149 (sal.████.com)Analysed#995995	Valid	Cross-site Scripting	None	2020-11-09	–	84
Deprecated Hacker101 coursework repository mentions Heroku App that is susceptible to takeover#514451	Valid	Server-Side Request Forgery	None	2019-04-04	$500	68
LLM03: Training Data Poisoning via ASCII decoding#2370955	Informative	Injection and Smuggling	None	2024-05-28	–	61
Stored XSS on https://events.hackerone.com#1028332	Valid	Cross-site Scripting	None	2021-03-26	–	59
Register & create a ticket as somebody else on HackerOne Support#2082680	Valid	Misconfiguration and Insecure Design	None	2023-07-31	–	56
Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.io#1028345	Valid	Open Redirect	None	2021-03-26	–	54
Bypassing Two-Factor Authentication via Account Deactivation and Password Reset#2543342	Duplicate	Access Control	None	2024-07-11	–	33
Open Redirection in [https://www.hackerone.com/index.php]#562417	Valid	Open Redirect	None	2019-05-08	–	33
Reflected XSS and possible SSRF/XXE on https://events.hackerone.com/conferences/get_recording_slides_xml.xml?url=myserver/xss.xml#1028396	Valid	Cross-site Scripting	None	2021-03-26	–	32
2fa can't be activated on app.pullrequest.com#2463069	Informative	Misconfiguration and Insecure Design	None	2024-07-11	–	25
Used email confirmation link reveals the email address which is tied to it#1128358	Valid	Information Disclosure	None	2021-09-22	–	21
CSV injection in the credentials export#1131887	Valid	Misconfiguration and Insecure Design	None	2021-09-22	–	6

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,199 analysed so far), which can be wrong. Data as of 2026-11-14.