Skip to content
Sign in

Bug bounty reports15,219

Atlas

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Program:HackerOne
Status:Duplicate
Clear
Severity
Weakness
Year
Bounty paid0
Access stated
  • No account0
  • A user account0
  • Admin or privileged0
Access needed
  • No account0
  • A user account0
  • A privileged role0
  • Admin0
  • Physical or local access0
  • Not clear from the report0
Clear filters17 of 15,219 reports
Disclosed bug bounty reports
ReportStatusWeaknessSeverityDisclosedBountyVotes
View any user email using the Team's audit log section#2404415DuplicateInformation DisclosureCritical2024-03-26–61
Two factor authentication bypass#2463279DuplicateNo weakness recordedMedium2024-07-11–47
Business Logic error leads to bypass 2FA requirement#2571981DuplicateInput Validation and LogicHigh2024-07-11–39
Reset the 2FA of the user which can lead to Account Takeover#2492631DuplicateAccess ControlMedium2024-07-11–37
Two-factor authentication bypass lead to information disclosure about the program and all hackers participate#2486086DuplicateInformation DisclosureHigh2024-07-11–37
Timing attack towards endpoints on the web without CSRF#348168DuplicateInformation Disclosure–2018-12-27–34
Bypassing Two-Factor Authentication via Account Deactivation and Password Reset#2543342DuplicateAccess ControlNone2024-07-11–33
IDOR on Program Visibilty (Revealed / Concealed) against other team members#291721DuplicateInsecure Direct Object Reference–2017-11-23–33
Improper Authentication - 2FA OTP Reusable#2529780DuplicateAuthenticationHigh2024-07-11–31
Able To Check The Exact Bounty Balance of any Bug Bounty Program#293593DuplicateInformation Disclosure–2017-12-06–27
Introspection query leaks sensitive graphql system information.#291531DuplicateMisconfiguration and Insecure Design–2017-11-22–22
Lack of cross-origin request blocking allows leaking of sensitive information on several endpoints#350739DuplicateInformation Disclosure–2018-06-07–15
Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FA#2575079DuplicateNo weakness recordedMedium2024-07-11–13
javascript: and mailto: links are allowed in JIRA integration settings#209917DuplicateMisconfiguration and Insecure Design–2017-04-10–12
Information disclosure#350432DuplicateInformation Disclosure–2018-12-27–8
Private Program all members disclosed#283309DuplicateInformation Disclosure–2017-11-16–8
Email Address Leak#123170DuplicateInformation Disclosure–2016-03-31–4

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in