Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Server version disclosure#149483 | Informative | Information Disclosure | – | 2016-07-07 | – | 13 |
| Google Maps API Key Leakage#1321830 | Informative | Information Disclosure | None | 2021-09-03 | – | 8 |
| stack trace exposed on https://receipts.uber.com/#204568 | Informative | Information Disclosure | Medium | 2021-02-25 | – | 8 |
| Can add employee in business.uber.com without add payment method#153175 | Informative | Authentication | – | 2016-07-26 | – | 8 |
| It's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without#298862 | Informative | Authentication | Medium | 2017-12-26 | – | 7 |
| Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication#298990 | Informative | Authentication | Medium | 2017-12-26 | – | 6 |
| Stored Cross Site Scripting [SELF] in partners.uber.com#125503 | Informative | Cross-site Scripting | – | 2016-06-13 | – | 6 |
| The Uber Promo Customer Endpoint Does Not Implement Multifactor Authentication, Blacklisting or Rate Limiting#293359 | Informative | Authentication | High | 2017-12-24 | – | 5 |
| Email Address Enumeration#144803 | Informative | Misconfiguration and Insecure Design | – | 2016-07-07 | – | 5 |
| Password Reset Does Not Confirm the Existence of an Email Address#143291 | Informative | Authentication | – | 2016-06-07 | – | 5 |
| Defect-Security | Driver-Broken Authentication | Able to update the Subscription Setting anonymously#134206 | Informative | Authentication | – | 2016-07-26 | – | 5 |
| XSS in uber oauth#131052 | Informative | Cross-site Scripting | – | 2016-07-26 | – | 5 |
| Authentication Issue for easter egg on bonjour.uber.com#146838 | Informative | Authentication | – | 2016-07-07 | – | 4 |
| Header Injection#143076 | Informative | Denial of Service | – | 2016-07-08 | – | 4 |
| Missing authentication on Notification setting .#135891 | Informative | Authentication | – | 2016-07-26 | – | 4 |
| XSS via password recovering#131123 | Informative | Cross-site Scripting | – | 2016-07-26 | – | 4 |
| Disclosure of ways to the site root#129027 | Informative | Information Disclosure | – | 2016-06-13 | – | 4 |
| text injection in get.uber.com/check-otp#126235 | Informative | No weakness recorded | – | 2016-09-16 | – | 4 |
| LIsting of http://archive.uber.com/pypi/simple/#125068 | Informative | Information Disclosure | – | 2016-03-24 | – | 4 |
| The Microsoft Store Uber App Does Not Implement Server-side Token Revocation#293363 | Informative | Authentication | Medium | 2017-12-24 | – | 3 |
| Text Only Content Spoofing on ubermovement.com Community Page#153095 | Informative | Misconfiguration and Insecure Design | – | 2016-07-26 | – | 3 |
| Newsroom.uber HTML form without CSRF protection#144147 | Informative | Cross-Site Request Forgery | – | 2016-07-07 | – | 3 |
| Email Enumeration Vulnerability#143672 | Informative | No weakness recorded | – | 2016-07-07 | – | 3 |
| Phone Number Enumeration#138881 | Informative | Information Disclosure | – | 2016-07-07 | – | 3 |
| Self-XSS on partners.uber.com#138622 | Informative | Cross-site Scripting | – | 2016-07-26 | – | 3 |
| Uber for Business Allows Administrators to Change Uber Driver Ratings Due to Failure to Authenticate `fast-rating` Endpoint#134521 | Informative | Authentication | – | 2016-07-26 | – | 3 |
| Information Disclosure on lite.uber.com#133375 | Informative | Information Disclosure | – | 2016-07-07 | – | 3 |
| Unsubscribe any user from receiving email#130521 | Informative | Misconfiguration and Insecure Design | – | 2016-06-13 | – | 3 |
| Create account in uber without signup form#125242 | Informative | Authentication | – | 2016-06-13 | – | 3 |
| User Enumeration and Information Disclosure#155578 | Informative | Information Disclosure | – | 2016-08-12 | – | 2 |
| faspex.uber.com uses an invalid SSL certificate#146847 | Informative | Cryptography | – | 2016-07-07 | – | 2 |
| Server version disclosure: team.uberinternal.com#146327 | Informative | Information Disclosure | – | 2016-07-07 | – | 2 |
| Information disclosure at lite.uber.com#128853 | Informative | Information Disclosure | – | 2016-06-13 | – | 2 |
| Session Impersonation in riders.uber.com#127645 | Informative | Authentication | – | 2016-06-13 | – | 2 |
| It is possible to re-rate a driver after a very long time#126835 | Informative | Misconfiguration and Insecure Design | – | 2016-04-25 | – | 2 |
| Pixel flood attack in https://riders.uber.com/profile#126826 | Informative | Denial of Service | – | 2016-04-25 | – | 2 |
| Disclosure of ip addresses in local network of uber#126569 | Informative | Information Disclosure | – | 2016-06-13 | – | 2 |
| Cross-site Scripting (XSS) autocomplete generation in https://www.uber.com/#124975 | Informative | Cross-site Scripting | – | 2016-03-24 | – | 2 |
| Active Email Hyperlink Sent on riders.uber.com#122791 | Informative | Misconfiguration and Insecure Design | – | 2016-06-13 | – | 2 |
| Design Issue at riders.uber.com/profile#298888 | Informative | Input Validation and Logic | None | 2017-12-28 | – | 1 |
| Command Injection, Information#146735 | Informative | Command and Code Injection | – | 2016-07-07 | – | 1 |
| Error Message on 404 page#145893 | Informative | No weakness recorded | – | 2016-07-07 | – | 1 |
| DOM based XSS on#139875 | Informative | Command and Code Injection | – | 2016-05-26 | – | 1 |
| Clickjacking in love.uber.com#137152 | Informative | Misconfiguration and Insecure Design | – | 2016-07-07 | – | 1 |
| developer.uber.com/404 and developer.uber.com/docs/404 are susceptible to iframes#130136 | Informative | No weakness recorded | – | 2016-06-13 | – | 1 |
| Brute Forcing rider-view Endpoint Allows for Counting Number of Active Uber Drivers#127025 | Informative | Information Disclosure | – | 2016-06-13 | – | 1 |
| Changing Driver Passwords With Only an Authenticated Session (no password, no email)#126377 | Informative | Misconfiguration and Insecure Design | – | 2016-06-13 | – | 1 |
| Uploading Plain Text to uber-documents.s3.amazonaws.com Through the Driver Document Upload Page#126374 | Informative | Misconfiguration and Insecure Design | – | 2016-06-13 | – | 1 |
| Brute Force Amplification Attack#125624 | Informative | Misconfiguration and Insecure Design | – | 2016-08-12 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.