Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Race condition in performing retest allows duplicated paymentsAnalysed#429026 | Valid | Race Conditions | Medium | 2018-12-27 | – | 240 |
| Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.comAnalysed#381356 | Valid | Input Validation and Logic | Low | 2019-04-05 | – | 154 |
| Race Condition leads to undeletable group memberAnalysed#604534 | Valid | Race Conditions | Low | 2020-03-20 | – | 153 |
| Bypassing HackerOne 2FA due to race conditionAnalysed#2598548 | Valid | Input Validation and Logic | Medium | 2024-10-30 | – | 139 |
| Race Conditions in Popular reports feature.Analysed#146845 | Valid | Memory Corruption | – | 2016-08-03 | – | 125 |
| Race Condition in Flag SubmissionAnalysed#454949 | Valid | Race Conditions | Low | 2019-07-22 | – | 94 |
| Bypass of #2035332 RXSS at image.hackerone.live via the `url` parameterAnalysed#2106708 | Valid | Cross-site Scripting | Low | 2023-08-22 | – | 80 |
| Race condition leads to duplicate payoutsAnalysed#220445 | Valid | Access Control | Low | 2017-05-23 | – | 73 |
| Race condition in joining CTF groupAnalysed#1540969 | Valid | Race Conditions | Low | 2023-01-08 | $500 | 72 |
| Race condition in claiming program credentialsAnalysed#488985 | Valid | Race Conditions | Low | 2019-05-19 | – | 54 |
| Race condition allows to send multiple times feedback for the hackerAnalysed#1132171 | Valid | Race Conditions | Low | 2021-09-22 | – | 18 |
| Race Conditions Exist When Accepting InvitationsAnalysed#119354 | Valid | Misconfiguration and Insecure Design | – | 2016-04-26 | – | 14 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.