Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterAnalysed#542340	Valid	Information Disclosure	High	2019-09-09	–	643
Chained Bugs to Leak Victim's Uber's FB Oauth TokenAnalysed#202781	Valid	Authentication	High	2019-01-25	–	427
Open Redirect on central.uber.com allows for account takeoverAnalysed#206591	Valid	Authentication	High	2019-01-25	–	144
Client secret, server tokens for developer applications returned by internal APIAnalysed#419655	Valid	Information Disclosure	–	2019-02-08	–	125
Lack of proper paymentProfileUUID validation allows any number of free rides without any outstanding balanceAnalysed#574638	Valid	Input Validation and Logic	Medium	2019-07-18	–	82
Subdomain takeover at signup.uber.comAnalysed#197489	Valid	Access Control	High	2019-01-25	–	79
Reflected XSS POST method at partners.uber.comAnalysed#129582	Valid	Cross-site Scripting	Medium	2019-01-25	$3,000	31
IDOR in activateFuelCard id allows bulk lookup of driver uuidsAnalysed#254151	Valid	Insecure Direct Object Reference	Low	2019-01-25	–	28

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.