Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessAny class
- Any class
- Cross-site Scripting49
- Cross-Site Request Forgery9
- Open Redirect3
- Server-Side Request Forgery3
- SQL Injection7
- Command and Code Injection11
- File and Path Handling1
- Memory Corruption1
- Denial of Service7
- Input Validation and Logic7
- Misconfiguration and Insecure Design17
- Cryptography6
- Information Disclosure44
- Authentication40
- Access Control11
- Insecure Direct Object Reference6
- No weakness recorded17
Access (title)Any
Access (analysis)Any
TechniqueAny
239 of 15,219 reports · $249,450 in bounties · 161 analysed so far
- #542340ValidAnalysedSensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterUber · Information Disclosure · 2019 · needs: no account · Missing authorisation check, IDOR / object reference, Leaked secret or key–643votes
- #591813ValidAnalysed[Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoUber · Information Disclosure · 2021 · needs: no account · Leaked secret or key$40,000458votes
- #202781ValidAnalysedChained Bugs to Leak Victim's Uber's FB Oauth TokenUber · Authentication · 2019 · needs: no account · OAuth redirect_uri abuse, Account takeover chain–427votes
- #340431ValidAnalysedReflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sgUber · Cryptography · 2020 · needs: not clear from the report · Reflected XSS, Information disclosure$4,000376votes
- #1007014ValidAnalysedRCE via npm misconfig -- installing internal libraries from the public registryUber · Command and Code Injection · 2021 · needs: no account · Dependency confusion / supply chain, Code injection / eval$9,000325votes
- #143717ValidAnalysedChange any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Uber · Authentication · 2016 · needs: no account · Authentication bypass, Account takeover chain, Password reset flaw–312votes
- #156098N/AXSS At "pages.et.uber.com"Uber · Cross-site Scripting · 2016–267votes
- #131450ValidStored XSS in developer.uber.comUber · Cross-site Scripting · 2016$7,500223votes
- #530441ValidUnauthorized access to █████████.com allows access to Uber Brazil tax documents and system.Uber · Access Control · 2021$4,500210votes
- #219205ValidAuthentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comUber · Authentication · 2017–183votes
- #206591ValidOpen Redirect on central.uber.com allows for account takeoverUber · Authentication · 2019–144votes
- #156536ValidReading Emails in Uber SubdomainsUber · Authentication · 2016–141votes
- #125980Validuber.com may RCE by Flask Jinja2 Template InjectionUber · Command and Code Injection · 2016$10,000137votes
- #392106Valid[First 30] Stored XSS on login.uber.com/oauth/v2/authorize via redirect_uri parameterUber · Cross-site Scripting · 2021$3,000131votes
- #419655ValidClient secret, server tokens for developer applications returned by internal APIUber · Information Disclosure · 2019–125votes
- #1116387ValidIDOR leads to leak analytics of any restaurantUber · Insecure Direct Object Reference · 2021–123votes
- #390386ValidReflected XSS on https://www.uber.comUber · No weakness recorded · 2021–114votes
- #1137819ValidIDOR leads to See analytics of Loyalty Program in any restaurant.Uber · Insecure Direct Object Reference · 2021–112votes
- #304190Validubernycmarketplace.com is vulnerable to the Heartbleed BugUber · Information Disclosure · 2020$1,500112votes
- #217739ValidStored XSS on any page in most Uber domainsUber · Cross-site Scripting · 2018$6,000107votes
- #173551Validpassword reset token leaking allowed for ATO of an Uber accountUber · Authentication · 2017$10,000100votes
- #150156ValidSQL Injection on sctrack.email.uber.com.cnUber · SQL Injection · 2016$4,00093votes
- #174404Validprivate passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") eventsUber · Information Disclosure · 2021–91votes
- #1883806ValidComplete Admin account takeover due to PhpDebugBar turned on in Uber's production serverUber · Misconfiguration and Insecure Design · 2023–90votes
- #136885Valid[CRITICAL] -- Complete Account TakeoverUber · Authentication · 2016$8,00089votes
- #223014ValidSAML Authentication Bypass on uchat.uberinternal.comUber · Authentication · 2017$8,50088votes
- #138869ValidOneLogin authentication bypass on WordPress sites via XMLRPCUber · Command and Code Injection · 2016$7,00083votes
- #574638ValidLack of proper paymentProfileUUID validation allows any number of free rides without any outstanding balanceUber · Input Validation and Logic · 2019–82votes
- #127158ValidPossibility to get private email using UUIDUber · Information Disclosure · 2016–82votes
- #540242ValidPre-auth Remote Code Execution on multiple Uber SSL VPN serversUber · Command and Code Injection · 2021 · no account (title)$2,00080votes
- #197489ValidSubdomain takeover at signup.uber.comUber · Access Control · 2019–79votes
- #162809ValidChanging paymentProfileUuid when booking a trip allows free ridesUber · Cross-Site Request Forgery · 2016–73votes
- #361438ValidOpen AWS S3 bucket at ubergreece.s3.amazonaws.com exposes confidential internal documents and filesUber · Information Disclosure · 2021$50070votes
- #175070ValidSubdomain takeover on rider.uber.com due to non-existent distribution on CloudfrontUber · Access Control · 2016–69votes
- #162199ValidLack of payment type validation in dial.uber.com allows for free ridesUber · Input Validation and Logic · 2018–68votes
- #1148697ValidChain of IDORs Between U4B and Vouchers APIs Allows Attackers to View and Modify Program/Voucher Policies and to Obtain Organization Employees' PIIUber · Insecure Direct Object Reference · 2022–64votes
- #145278Validxss in https://www.uber.comUber · Cross-site Scripting · 2016–64votes
- #191196ValidAuthorization issue in Google G Suite allows DoS through HTTP redirectUber · Denial of Service · 2017–62votes
- #300779ValidHack The World 2017 Top 2 BonusUber · No weakness recorded · 2018$5,00061votes
- #206872ValidSQL injection in 3rd party software AnomaliUber · SQL Injection · 2017$2,50061votes
- #1145428ValidChain of vulnerabilities in Uber for Business Vouchers program allows for attacker to perform arbitrary charges to victim's U4B payment accountUber · Insecure Direct Object Reference · 2021$5,75058votes
- #1005355ValidUnrestricted File Upload Results in Cross-Site Scripting AttacksUber · Cross-site Scripting · 2021–58votes
- #136169ValidOneLogin authentication bypass on WordPress sitesUber · Authentication · 2016$10,00058votes
- #154096ValidBlind OOB XXE At "http://ubermovement.com/"Uber · Command and Code Injection · 2016$50056votes
- #135288ValidMultiple vulnerabilities in a WordPress plugin at drive.uber.comUber · SQL Injection · 2016–55votes
- #472470Valid[manage.jumpbikes.com] Blind XSS on Jump admin panel via user nameUber · Cross-site Scripting · 2021–54votes
- #397497ValidStored XSS on auth.uber.com/oauth/v2/authorize via redirect_uri parameter leads to Account TakeoverUber · Cross-site Scripting · 2021$3,00052votes
- #256152ValidPossibility to inject a malicious JavaScript code in any file on tags.tiqcdn.com results in a stored XSS on any page in most Uber domainsUber · Cross-site Scripting · 2018$6,00051votes
- #201326Valid[uchat.uberinternals.com] Mattermost doesn't check Origin in Websockets, which leads to the Critical Inforamation Leakage.Uber · Cross-Site Request Forgery · 2023$2,00050votes
- #953649ValidCritical Information disclosure of rtapi token for any user via https://video-support-staging.uber.com/video/api/getPopulousUserUber · Information Disclosure · 2021–49votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.