Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| XXE on sms-be-vip.twitter.com in SXMP ProcessorAnalysed#248668 | Valid | Injection and Smuggling | Medium | 2017-07-26 | – | 258 |
| Vine all registered user Private/sensitive information disclosure .[ Ip address/phone no/email and many other informations ]Analysed#202823 | Valid | Information Disclosure | Critical | 2017-07-11 | – | 121 |
| [URGENT] Opportunity to publish tweets on any twitters accountAnalysed#208978 | Valid | No weakness recorded | High | 2017-05-22 | – | 119 |
| Remote Unrestricted file Creation/Deletion and Possible RCE.Analysed#191884 | Valid | Command and Code Injection | Low | 2017-02-26 | – | 100 |
| Attacker can get vine repost user all informations even Ip address and location .Analysed#201300 | Valid | Authentication | – | 2017-03-25 | – | 95 |
| Bypassing Digits bridge origin validationAnalysed#110467 | Valid | Authentication | – | 2017-04-30 | – | 92 |
| [CRITICAL] Full account takeover using CSRFAnalysed#235642 | Valid | Cross-Site Request Forgery | High | 2017-11-03 | – | 88 |
| [Studio.twitter.com] See someone else picsAnalysed#164649 | Valid | Authentication | – | 2017-06-22 | – | 84 |
| [dev.twitter.com] XSS and Open RedirectAnalysed#260744 | Valid | No weakness recorded | Medium | 2017-09-29 | $1,120 | 75 |
| CSRF on Periscope Web OAuth authorization endpointAnalysed#215381 | Valid | Cross-Site Request Forgery | – | 2017-07-26 | – | 74 |
| Multiple DOMXSS on Amplify Web PlayerAnalysed#88719 | Valid | Cross-site Scripting | – | 2017-04-15 | – | 66 |
| DOM based cookie bombAnalysed#57356 | Valid | Denial of Service | – | 2017-04-11 | – | 55 |
| csp bypass + xssAnalysed#153666 | Valid | Cross-site Scripting | – | 2017-07-05 | – | 51 |
| DOMXSS in TweetdeckAnalysed#119471 | Valid | Cross-site Scripting | – | 2017-04-02 | – | 50 |
| Stealing User emails by clickjacking cards.twitter.com/xxx/xxxAnalysed#154963 | Valid | Misconfiguration and Insecure Design | Medium | 2017-02-03 | – | 49 |
| Opportunity to obtain private tweets through search widget preview cachesAnalysed#263760 | Valid | Input Validation and Logic | – | 2017-11-11 | $1,120 | 48 |
| Open RedirectAnalysed#246897 | Valid | Open Redirect | – | 2017-08-19 | – | 41 |
| CSRF on cards APIAnalysed#95555 | Valid | Cross-Site Request Forgery | – | 2017-04-11 | – | 41 |
| niche s3 buckets are readable/writeable/deleteable by authorized AWS usersAnalysed#129381 | Valid | Authentication | – | 2017-04-02 | – | 39 |
| [IDOR][translate.twitter.com] Opportunity to change any comment at the forumAnalysed#181748 | Valid | Access Control | Low | 2017-05-12 | – | 38 |
| Listing of Amazon S3 Bucket accessible to any amazon authenticated user (metrics.pscp.tv)Analysed#278191 | Valid | Information Disclosure | – | 2017-11-19 | $140 | 36 |
| CRLF and XSS stored on ton.twitter.comAnalysed#191380 | Valid | Cross-site Scripting | – | 2017-07-05 | $1,680 | 32 |
| HTTP 401 response injection on "amp.twimg.com/amplify-web-player/prod/source.html" through "image_src" parameterAnalysed#221328 | Valid | Information Disclosure | Low | 2017-05-08 | – | 30 |
| GNIP subdomain take overAnalysed#189548 | Valid | No weakness recorded | High | 2017-02-06 | – | 30 |
| Vine - overwrite account associated with email via android applicationAnalysed#187714 | Valid | Authentication | Medium | 2017-06-14 | $280 | 30 |
| Open Redirect Protection BypassAnalysed#283460 | Valid | Open Redirect | – | 2017-12-23 | – | 24 |
| Twitter for android is exposing user's location to any installed android appAnalysed#185862 | Valid | Information Disclosure | Low | 2017-01-13 | $560 | 23 |
| Unauthorized Access to Protected Tweets via niche.co APIAnalysed#273698 | Valid | Information Disclosure | High | 2017-11-02 | – | 22 |
| Sensitive Information Disclosure https://cards-dev.twitter.comAnalysed#268888 | Valid | Information Disclosure | Medium | 2017-09-29 | $280 | 19 |
| [██████████.gnip.com] .htpasswd disclosureAnalysed#219197 | Valid | No weakness recorded | Critical | 2017-05-26 | – | 19 |
| SSRF in https://cards-dev.twitter.com/validatorAnalysed#178184 | Valid | Server-Side Request Forgery | Medium | 2017-04-06 | – | 16 |
| leaking Digits OAuth authorization to third party websitesAnalysed#166942 | Valid | Information Disclosure | – | 2017-01-24 | – | 13 |
| [Gnip Blogs] Reflected XSS via "plupload.flash.swf" component vulnerable to SOME#218451 | Valid | Cross-site Scripting | Medium | 2017-05-08 | – | 11 |
| Clickjacking Periscope.tv on Chrome#198622 | Valid | Misconfiguration and Insecure Design | Medium | 2017-02-06 | $560 | 11 |
| CSRF in twitterflightschool.com ( CAN POST ON TIMELINE WITHOUT USER PERMISSION)#115158 | Valid | Cross-Site Request Forgery | – | 2017-11-06 | – | 8 |
| Sub Domain Takeover at mk.prd.vine.co#191323 | Valid | No weakness recorded | – | 2017-02-13 | $140 | 7 |
| OS Command Execution on User's PC via CSV Injection#282628 | Informative | Command and Code Injection | Medium | 2017-11-02 | – | 2 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.