Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organizationAnalysed#2101076	Valid	Memory Corruption	High	2024-02-04	–	228
Hacker can bypass 2FA requirement and reporter blacklist through embedded submission formAnalysed#418767	Valid	Access Control	Medium	2018-10-31	$10,000	208
Web Authentication Endpoint Credentials Brute-Force VulnerabilityAnalysed#127844	Valid	Authentication	–	2016-06-23	–	161
Hackerone supports accounts organitation takeoverAnalysed#2798380	Valid	No weakness recorded	Medium	2024-11-19	$2,500	155
Bypass report submit restriction/ban using the API keyAnalysed#2081930	Valid	Access Control	Medium	2023-10-29	–	91
Changing the 2FA secret key and backup codes without knowing the 2FA OTPAnalysed#1139535	Valid	Other weaknesses	Medium	2021-05-06	–	57
Register & create a ticket as somebody else on HackerOne SupportAnalysed#2082680	Valid	Misconfiguration and Insecure Design	None	2023-07-31	–	56
Private program email forwarding response invitation not expire after first use.Analysed#209140	Valid	Misconfiguration and Insecure Design	High	2018-05-30	–	38
Able to create basic user account via Google login on HackerOne Drupal CMSAnalysed#208407	Valid	Authentication	–	2017-04-25	–	20

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.