Intel · bug bounty

Disclosed bug bounty reports

Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.

SortMost upvoted

StatusValid

SeverityAny

DisclosedAny year

WeaknessAny class

Access (title)Any

Access (analysis)Any

TechniqueAny

HackerOne Clear

528 of 15,219 reports · $318,600 in bounties · 227 analysed so far

#745324ValidAnalysedAccount takeover via leaked session cookieHackerOne · Authentication · 2019 · needs: no account · Account takeover chain, Session fixation or reuse, Information disclosure$20,0001,642votes
#489146ValidAnalysedConfidential data of users and limited metadata of programs and reports accessible via GraphQLHackerOne · Information Disclosure · 2019 · needs: not clear from the report · Missing authorisation check, Information disclosure–1,033votes
#228648ValidAnalysedWannaCrypt “Killswitch”HackerOne · No weakness recorded · 2017 · needs: no account · Business logic flaw–809votes
#792927ValidAnalysedEmail address of any user can be queried on Report Invitation GraphQL type when username is knownHackerOne · Access Control · 2020 · needs: a user account · Missing authorisation check, Information disclosure–671votes
#3000510ValidAnalysedThe /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is presentHackerOne · Information Disclosure · 2025 · Critical · needs: no account · Information disclosure–625votes
#807448ValidAnalysedCustomer private program can disclose email any users through invited via usernameHackerOne · Information Disclosure · 2020 · needs: a user account · Information disclosure, Missing authorisation check$7,500589votes
#2262382ValidAnalysedServer Side Request Forgery (SSRF) via Analytics ReportsHackerOne · Server-Side Request Forgery · 2023 · needs: no account · SSRF$25,000529votes
#764434ValidAnalysedprofile-picture name parameter with large value lead to DoS for other users and programs on the platformHackerOne · Denial of Service · 2020 · needs: a user account · Denial of service, Business logic flaw–475votes
#762510ValidAnalysedHow the Bug stole hackingHackerOne · Insecure Direct Object Reference · 2019 · needs: not clear from the report · Information disclosure–471votes
#2032716ValidAnalysedAn attacker can can view any hacker email via /SaveCollaboratorsMutation operation nameHackerOne · Information Disclosure · 2023 · needs: a user account · Information disclosure$12,500429votes
#1622449ValidAnalysedJune 2022 Incident ReportHackerOne · No weakness recorded · 2022 · needs: a privileged role · Missing authorisation check, Information disclosure, Business logic flaw–426votes
#2122671ValidAnalysedIDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL queryHackerOne · Insecure Direct Object Reference · 2023 · needs: a user account · IDOR / object reference, Missing authorisation check–395votes
#840759ValidAnalysedReflected XSS on www.hackerone.com and resources.hackerone.comHackerOne · Cross-site Scripting · 2020 · needs: no account · Reflected XSS$500387votes
#3862641ValidAnalysedIDOR allows user to access report details via reference.json endpointHackerOne · Insecure Direct Object Reference · 2026 · Critical · needs: a user account · IDOR / object reference, Information disclosure, Missing authorisation check$15,000372votes
#1858574ValidAnalysed[CVE-2022-44268] Arbitrary Remote Leak via ImageMagickHackerOne · File and Path Handling · 2023 · needs: a user account · Local file inclusion, Unsafe file upload, Information disclosure, Leaked secret or key–371votes
#1133118ValidAnalysedHackerone is not properly deleting user idHackerOne · Input Validation and Logic · 2021 · needs: a user account · Information disclosure, Business logic flaw–356votes
#182358ValidAnalysedPartial disclosure of report activity through new "Export as .zip" featureHackerOne · Information Disclosure · 2016 · needs: a user account · Information disclosure, Missing authorisation check$10,000355votes
#1969141ValidAnalysedInsecure Direct Object Reference (IDOR) - Delete CampaignsHackerOne · Insecure Direct Object Reference · 2023 · needs: a user account · IDOR / object reference, Missing authorisation check–346votes
#2442008ValidAnalysedAttachment disclosure via summary reportHackerOne · Insecure Direct Object Reference · 2024 · needs: a user account · IDOR / object reference, Information disclosure–340votes
#999789ValidAnalysedGetting New Invitations without Leaving ProgramsHackerOne · Input Validation and Logic · 2020 · needs: a user account · Business logic flaw, Parameter pollution–322votes
#1501611ValidAnalysedAn attacker can archive and unarchive any structured scope object on HackerOneHackerOne · No weakness recorded · 2022 · needs: a user account · IDOR / object reference, Missing authorisation check–318votes
#1618347ValidAnalysedDisclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`HackerOne · No weakness recorded · 2025 · Critical · needs: no account · Missing authorisation check, Information disclosure$25,000295votes
#188719ValidAnalysedInformation Disclosure in /skills callHackerOne · Information Disclosure · 2017 · needs: a user account · Information disclosure, IDOR / object reference$10,000287votes
#186230ValidAnalysedInternal attachments can be exported via "Export as .zip" featureHackerOne · Information Disclosure · 2016 · needs: a user account · Information disclosure, IDOR / object reference$12,500269votes
#605720ValidAnalysedTeam member with Program permission only can escalate to Admin permissionHackerOne · Access Control · 2019 · needs: a user account · Privilege escalation, Missing authorisation check, Information disclosure–268votes
#2487889ValidAnalysedInsecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json EndpointHackerOne · Insecure Direct Object Reference · 2024 · Critical · needs: not clear from the report · IDOR / object reference, Missing authorisation check, Information disclosure–266votes
#2312029ValidAnalysedView Titles of Private Reports with pending email invitationHackerOne · Access Control · 2024 · needs: no account · Missing authorisation check, Information disclosure–257votes
#409370ValidAnalysedDenial of service via cache poisoningHackerOne · Denial of Service · 2018 · needs: no account · Cache poisoning, Host header abuse, Denial of service$2,500253votes
#429026ValidAnalysedRace condition in performing retest allows duplicated paymentsHackerOne · Race Conditions · 2018 · needs: a user account · Race condition, Business logic flaw–240votes
#474656ValidAnalysedCross-site Scripting (XSS) on HackerOne careers pageHackerOne · Cross-site Scripting · 2019 · needs: no account · DOM XSS, HTML injection$500239votes
#986386ValidAnalysedReflected XSS on www.hackerone.com via Wistia embed codeHackerOne · Cross-site Scripting · 2020 · needs: no account · Reflected XSS, Prototype pollution, CSP bypass$500236votes
#3178999ValidAnalysedAccount takeover of existing HackerOne accounts through SCIM provisioningHackerOne · Access Control · 2025 · High · needs: a privileged role · Account takeover chain, Missing authorisation check, Password reset flaw, E-mail verification bypass–232votes
#2101076ValidHackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organizationHackerOne · Memory Corruption · 2024–228votes
#1181946ValidStatic files on HackerOne.com can be made inaccessible through Cache Poisoning attackHackerOne · Denial of Service · 2021–228votes
#3113398ValidInternal Access to Hackerone confluence DocsHackerOne · Misconfiguration and Insecure Design · 2025 · High$12,500227votes
#2937622ValidPublic GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports informationHackerOne · Information Disclosure · 2025 · Medium–226votes
#2180521ValidGoogle Docs link in JS files allows editing & reading survey informationHackerOne · Information Disclosure · 2023–217votes
#1103582ValidHackerOne Jira integration plugin Leaked JWT to unauthorized jira usersHackerOne · Authentication · 2021$3,000213votes
#654198ValidManipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve statusHackerOne · Information Disclosure · 2019$500213votes
#2218334ValidIDOR vulnerability in unreleased HackerOne Copilot featureHackerOne · Insecure Direct Object Reference · 2023–210votes
#887321ValidUploading large payload on domain instructions causes server-side DoSHackerOne · Denial of Service · 2020$2,500210votes
#418767ValidHacker can bypass 2FA requirement and reporter blacklist through embedded submission formHackerOne · Access Control · 2018$10,000208votes
#398054ValidDOM Based XSS in www.hackerone.com via PostMessageHackerOne · Cross-site Scripting · 2019$500208votes
#1220747ValidHackerOne making payments in USDC (Coinbase stable coin)HackerOne · No weakness recorded · 2021–201votes
#1007689Valid2020-10-09 Credential Stuffing AttackHackerOne · No weakness recorded · 2020–196votes
#1034257ValidIndexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photosHackerOne · Misconfiguration and Insecure Design · 2021–194votes
#800109ValidAn invite-only's program submission state is accessible to users no longer part of the programHackerOne · Information Disclosure · 2020$500194votes
#871749ValidUnauthorized access to metadata of undisclosed reports that were retestedHackerOne · Information Disclosure · 2020–189votes
#1770797Validadding h1_analyst_* to username for normal usersHackerOne · Input Validation and Logic · 2023 · a user account (title)$500187votes
#3287208ValidDOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification APIHackerOne · No weakness recorded · 2026–185votes

The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.