Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Chained Bugs to Leak Victim's Uber's FB Oauth TokenAnalysed#202781	Valid	Authentication	High	2019-01-25	–	427
Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Analysed#143717	Valid	Authentication	–	2016-07-14	–	312
Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comAnalysed#219205	Valid	Authentication	Critical	2017-07-13	–	183
Open Redirect on central.uber.com allows for account takeoverAnalysed#206591	Valid	Authentication	High	2019-01-25	–	144
Stored XSS on any page in most Uber domainsAnalysed#217739	Valid	Cross-site Scripting	High	2018-11-20	$6,000	107
password reset token leaking allowed for ATO of an Uber accountAnalysed#173551	Valid	Authentication	Critical	2017-05-17	$10,000	100
Stealing users password (Limited Scenario)Analysed#163067	Valid	Misconfiguration and Insecure Design	–	2016-09-29	–	35
Cleartext password exposure allows access to the desafio5estrelas.com admin panelAnalysed#344566	Valid	Cryptography	Medium	2021-03-30	$500	20

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.