Skip to content
Connect AISign inSign up free

Bug bounty reports15,219

Atlas

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Program
Status:Duplicate
Clear
Severity
Weakness
Year
Bounty paid0
Access stated
Access needed
  • No account0
  • A user account0
  • A privileged role0
  • Admin0
  • Physical or local access0
  • Not clear from the report0
Clear filters300 of 15,219 reports
Disclosed bug bounty reports
ReportStatusProgramWeaknessSeverityDisclosedBountyVotes
Infromation Disclosure To Use of Hard-coded Cryptographic Key#2353237DuplicateRedditCryptographyMedium2024-02-06–238
Ability to getting Twitter Blue verified badge without purchase it#1841064DuplicateX / xAIInput Validation and LogicMedium2024-02-22–85
Unauthorized Reservation Cancellation Through IDOR Vulnerability#2944357DuplicateYelpInsecure Direct Object ReferenceHigh2025-01-29–79
open redirected by host header#2828499DuplicateLocalizeOpen Redirect–2024-12-02–73
Open Redirect Vulnerability in OAuth Flow Leading to Potential Phishing Attack#3099816DuplicateLichessOpen RedirectLow2025-05-15–70
Enable 2FA without verifying the email#3016540DuplicateXVIDEOSAccess ControlLow2025-05-09–70
View any user email using the Team's audit log section#2404415DuplicateHackerOneInformation DisclosureCritical2024-03-26–61
Privilege Escalation by abusing non-existent path. (Windows)#440963DuplicatePortSwigger Web SecurityAccess ControlMedium2019-03-13–59
Use-After-Free in SMB connection reuse (req->path dangling pointer after needle destruction)#3591956DuplicatecurlMemory CorruptionHigh2026-04-29–58
Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com#172137DuplicateUbiquiti Inc.Cross-Site Request ForgeryHigh2016-11-29–55
Full account takeover of any user through reset password#1175081DuplicateUPchieveAccess ControlCritical2021-05-14–54
Two factor authentication bypass#2463279DuplicateHackerOneNo weakness recordedMedium2024-07-11–47
Host header injection leads to account takeover#1623672DuplicateEnjinInjection and SmugglingHigh2024-10-15–47
Negotiate connection reuse with wrong credentials when using CURLAUTH_ANY#3646072DuplicatecurlAuthenticationMedium2026-04-29–45
[Wii U/3DS/Switch] Improper bounds check in StationURL in all NEX clients leading to remote crash/RCE#2551512DuplicateNintendoMemory CorruptionLow2026-08-07–42
[HTA2] Authorization Bypass on https://██████ leaks confidential aircraft/missile information#736391DuplicateU.S. Dept Of DefenseAccess ControlCritical2023-04-14–40
Negotiate Authentication Premature on Connection Reuse#3666576DuplicatecurlAuthenticationHigh2026-04-29–39
Business Logic error leads to bypass 2FA requirement#2571981DuplicateHackerOneInput Validation and LogicHigh2024-07-11–39
Reset the 2FA of the user which can lead to Account Takeover#2492631DuplicateHackerOneAccess ControlMedium2024-07-11–37
Two-factor authentication bypass lead to information disclosure about the program and all hackers participate#2486086DuplicateHackerOneInformation DisclosureHigh2024-07-11–37
Session Timeout Does Not Enforce Re-Authentication on AWS Access Portal#2800511DuplicateAWS VDPOther weaknessesMedium2025-03-05–36
CSRF on https://www.niche.co leads to "account disconnection"#493552DuplicateX / xAICross-Site Request ForgeryMedium2019-03-02–35
Timing attack towards endpoints on the web without CSRF#348168DuplicateHackerOneInformation DisclosureLow2018-12-27–34
Bypassing Two-Factor Authentication via Account Deactivation and Password Reset#2543342DuplicateHackerOneAccess ControlNone2024-07-11–33
IDOR on Program Visibilty (Revealed / Concealed) against other team members#291721DuplicateHackerOneInsecure Direct Object ReferenceMedium2017-11-23–33
Improper Authentication - 2FA OTP Reusable#2529780DuplicateHackerOneAuthenticationHigh2024-07-11–31
Development Application Credentials + Information Exposed#1018413DuplicateKubernetesCryptographyHigh2020-12-03–31
Able To Check The Exact Bounty Balance of any Bug Bounty Program#293593DuplicateHackerOneInformation DisclosureMedium2017-12-06–27
Sauce Labs API key unencrypted in an old commit#1302395DuplicateRuby on RailsCryptographyMedium2024-10-08–23
NEX: Stack overflow in UnicodeToUtf8#469997DuplicateNintendoMemory CorruptionNone2025-06-27–23
Kerberos/SPNEGO Connection Reuse Vulnerability#3725659DuplicatecurlNo weakness recorded–2026-05-14–22
Emails from Grammarly missing sanitization(lack of validation?) -> HTML injection in emails#404864DuplicateSuperhuman (formerly Grammarly)Misconfiguration and Insecure DesignLow2019-04-30–22
Introspection query leaks sensitive graphql system information.#291531DuplicateHackerOneMisconfiguration and Insecure Design–2017-11-22–22
Oauth Misconfiguration Lead To Account Takeover#1212374DuplicateRedditAccess ControlMedium2021-10-21–21
CORS Misconfiguration on nordvpn.com leading to Private Information Disclosure,Account takeover#758785No longer publicNord SecurityAccess Control–2020-02-21–21
IDOR when editing email leads to Mass Full ATOs (Account Takeovers) without user interaction on https://██████/#1687415DuplicateU.S. Dept Of DefenseInsecure Direct Object Reference–2023-01-06–19
Visibility Robots.txt file#1450014DuplicateKrispInformation Disclosure–2022-04-25–19
Missing SPF Records.#324372DuplicateMyCryptoNo weakness recordedMedium2018-05-24–18
Multiple Vulnerabilities (Including SQLi) in love.uber.com#117080DuplicateUberNo weakness recorded–2016-06-14–18
http request smuggling in twitter.com#715996DuplicateX / xAIInjection and SmugglingHigh2020-11-18–17
[airbnb.com] XSS via Cookie flash#197334DuplicateAirbnbCross-site ScriptingMedium2018-04-03–17
PI leakage By Brute Forcing and Phone number deleting without using password#1087525DuplicateX / xAIAccess ControlMedium2021-04-22–16
xmlrpc.php file is enable it will used for (Denial of Service) and bruteforce attack#747829DuplicateBlockDev Sp. Z o.oDenial of Service–2020-04-07–16
CSRF to delete accounts [HtUS]#1629828DuplicateU.S. Dept Of DefenseCross-Site Request ForgeryHigh2023-05-15–15
Stored XSS in Name of Team Member Invitation#786301DuplicateLocalizeCross-site ScriptingLow2020-02-06–15
Lack of cross-origin request blocking allows leaking of sensitive information on several endpoints#350739DuplicateHackerOneInformation Disclosure–2018-06-07–15
HTML Injection in Glassdoor job sharing emails#842050No longer publicGlassdoorInput Validation and Logic–2021-04-16–14
Blind SSRF in FogBugz project import#709951DuplicateGitLabServer-Side Request ForgeryMedium2023-05-30–14
Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FA#2575079DuplicateHackerOneNo weakness recordedMedium2024-07-11–13
private keys exposed on the GitHub repository#1255869DuplicateMCUbootCryptographyMedium2021-11-04–13

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated