Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Account takeover via leaked session cookieAnalysed#745324 | Valid | Authentication | High | 2019-12-03 | $20,000 | 1,642 |
| Account takeover of existing HackerOne accounts through SCIM provisioningAnalysed#3178999 | Valid | Access Control | High | 2025-07-17 | – | 232 |
| 2020-10-09 Credential Stuffing AttackAnalysed#1007689 | Valid | No weakness recorded | – | 2020-10-13 | – | 196 |
| Improper CSRF token validation allows attackers to access victim's accounts linked to HackeroneAnalysed#1727221 | Valid | Cross-Site Request Forgery | High | 2023-06-19 | – | 168 |
| Web Authentication Endpoint Credentials Brute-Force VulnerabilityAnalysed#127844 | Valid | Authentication | – | 2016-06-23 | – | 161 |
| HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocksAnalysed#4071670 | Valid | Authentication | Low | 2026-10-08 | $200 | 45 |
| Information disclosure (reset password token) and changing the user's passwordAnalysed#738 | Valid | Cross-Site Request Forgery | – | 2014-02-19 | $100 | 24 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.