Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Account takeover via leaked session cookieAnalysed#745324 | Valid | HackerOne | Authentication | High | 2019-12-03 | $20,000 | 1,642 |
| Potential pre-auth RCE on Twitter VPNAnalysed#591295 | Valid | X / xAI | Command and Code Injection | Critical | 2019-08-10 | $20,160 | 1,246 |
| Account takeover through the combination of cookie manipulation and XSSAnalysed#534450 | Valid | Superhuman (formerly Grammarly) | Cross-site Scripting | High | 2019-12-03 | – | 292 |
| [CRITICAL] 0-Click Account Takeover via Password Reset [AUTH-3243] /orchestrator/v1/password_reset/startAnalysed#2831902 | Valid | Remitly | Access Control | Critical | 2025-07-21 | – | 291 |
| Singapore - Account Takeover via IDORAnalysed#876300 | Valid | Starbucks | Insecure Direct Object Reference | Critical | 2020-07-28 | – | 260 |
| Privilege escalation from any user (including external) to gitlab admin when admin impersonates youAnalysed#493324 | Valid | GitLab | Access Control | Critical | 2020-08-26 | – | 256 |
| Spring Actuator endpoints publicly available and broken authenticationAnalysed#838635 | Valid | LY Corporation | Misconfiguration and Insecure Design | Critical | 2020-08-06 | $12,500 | 234 |
| Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comAnalysed#219205 | Valid | Uber | Authentication | Critical | 2017-07-13 | – | 183 |
| Previously created sessions continue being valid after MFA activationAnalysed#667739 | Valid | Superhuman (formerly Grammarly) | Access Control | Medium | 2019-08-19 | – | 176 |
| 1 click Account takeover via deeplink in [com.kayak.android]Analysed#1667998 | Valid | KAYAK | Access Control | Critical | 2023-01-19 | – | 173 |
| Session works after logout from Shopify account and password of online store is displayedAnalysed#837729 | Valid | Shopify | No weakness recorded | Low | 2020-04-27 | – | 157 |
| [Venmo Android] Remote theft of user sessionAnalysed#401940 | Valid | PayPal | Open Redirect | Medium | 2019-02-07 | – | 151 |
| H1514 Session Fixation on multiple shopify-built apps on *.shopifycloud.com and *.shopifyapps.comAnalysed#423136 | Valid | Shopify | Authentication | – | 2019-04-25 | – | 144 |
| Session Doesn't expire after 2fa and also other session can change passswordAnalysed#2234736 | Valid | SideFX | Access Control | Low | 2024-03-02 | $300 | 90 |
| No Session Expiry after log-out, attacker can reuse the old cookiesAnalysed#1162443 | Valid | Shopify | Authentication | Low | 2024-05-01 | $500 | 87 |
| elections.k8s.io uses weak session secret key, may place elections at riskAnalysed#1387366 | Valid | Kubernetes | Cryptography | High | 2025-09-19 | $250 | 86 |
| Possible Sensitive Session Information Leak in Active StorageAnalysed#3082917 | Valid | Internet Bug Bounty | Information Disclosure | High | 2025-04-27 | $4,323 | 82 |
| Cookie steal through content UriAnalysed#876192 | Valid | Brave Software | Authentication | Critical | 2021-04-22 | – | 79 |
| Two-factor authentication enforcement bypassAnalysed#1050244 | Valid | Nextcloud | No weakness recorded | High | 2021-07-31 | $750 | 64 |
| [Variation of #3321406] YetAnother 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in AccessTempAuthAnalysed#3423950 | Valid | Cloudflare Public Bug Bounty | Cross-site Scripting | High | 2026-04-14 | – | 63 |
| Insufficient session expiration in the **com.shopify.ping** android appAnalysed#1172205 | Valid | Shopify | Authentication | Low | 2021-11-26 | – | 63 |
| Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cliAnalysed#3073507 | Valid | Internet Bug Bounty | Authentication | Low | 2025-05-29 | – | 57 |
| Improper Session Invalidation – Auto Sign-In Without Credentials After Logout (Affects Chrome & Firefox)Analysed#3101207 | Valid | Dust | Authentication | Medium | 2025-04-29 | – | 56 |
| session takeover via open protocol redirection on streamlabs.comAnalysed#1178239 | Valid | Logitech | Open Redirect | Medium | 2021-09-01 | $200 | 50 |
| Revoking user session in https://hackerone.com/settings/sessions does not revoke the GraphQL query sessionAnalysed#417382 | Valid | HackerOne | Authentication | Low | 2018-11-30 | $500 | 47 |
| Rack parses encoded cookie names allowing an attacker to send malicious `__Host-` and `__Secure-` prefixed cookiesAnalysed#895727 | Valid | Ruby on Rails | Input Validation and Logic | Low | 2020-06-16 | – | 46 |
| Broken Authentication and Session Management Flaw After Change Password and LogoutAnalysed#634488 | Valid | Omise | Misconfiguration and Insecure Design | Low | 2020-11-08 | – | 45 |
| Changing the administrator password via admin console does not invalidate other sessionsAnalysed#2279041 | Valid | PortSwigger Web Security | Authentication | Low | 2024-05-20 | – | 41 |
| Account takeover via XSSAnalysed#735638 | Valid | Rocket.Chat | Cross-site Scripting | Critical | 2021-03-31 | – | 41 |
| Stored XSS in attachment-display exploitable through SameSiteAnalysed#3594137 | Valid | Nextcloud | Cross-site Scripting | Medium | 2026-04-19 | – | 39 |
| [Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp AuthAnalysed#3321406 | Valid | Cloudflare Public Bug Bounty | No weakness recorded | High | 2026-04-14 | – | 39 |
| Lack of session expiration after password reset on TikTok Careers PortalAnalysed#997127 | Valid | TikTok | Authentication | Low | 2021-03-03 | $50 | 38 |
| CVE-2026-7168: cross-proxy Digest auth state leakAnalysed#3697719 | Valid | curl | Information Disclosure | Medium | 2026-04-29 | – | 37 |
| [m.airbnb.com] CRLF InjectionAnalysed#197279 | Valid | Airbnb | Injection and Smuggling | Low | 2018-04-03 | $2,500 | 37 |
| Improper Session management can cause account takeover[https://micropurchase.18f.gov]Analysed#263873 | Valid | GSA Bounty | Authentication | Medium | 2019-07-30 | – | 36 |
| Broken Authentication and session management OWASP A2Analysed#284 | Valid | HackerOne | Authentication | – | 2014-01-09 | – | 36 |
| Broken Authentication Session Token BugAnalysed#948345 | Valid | Courier | Authentication | Medium | 2022-02-16 | – | 35 |
| 2FA Session not expires after the password resetAnalysed#486693 | Valid | Nextcloud | Authentication | Medium | 2021-01-18 | $50 | 35 |
| Bybass The Closing of the account and logged again to your accountAnalysed#167489 | Valid | Yelp | Authentication | – | 2016-10-21 | – | 34 |
| Being able to change account contents even after password changeAnalysed#662108 | Valid | Kartpay | Authentication | Medium | 2021-01-06 | – | 32 |
| XML‑RPC login leak exposes valid session ID enabling unauthorized API accessAnalysed#3783738 | Valid | Revive Adserver | Access Control | Medium | 2026-06-25 | – | 28 |
| Uninstalling Rockstar Games Launcher for Windows (64-bit), then reinstalling keeps you logged in without authenticationAnalysed#1278261 | Valid | Rockstar Games | Information Disclosure | Low | 2022-04-07 | $250 | 28 |
| CVE-2022-27779: cookie for trailing dot TLDAnalysed#1565615 | Valid | Internet Bug Bounty | Information Disclosure | Medium | 2022-06-11 | – | 27 |
| Switching the user to the attacker's accountAnalysed#727 | Valid | HackerOne | Cross-Site Request Forgery | – | 2014-02-20 | $150 | 27 |
| CVE-2023-40273: Session fixation in Apache Airflow web interfaceAnalysed#2121960 | Valid | Internet Bug Bounty | Authentication | Low | 2023-09-04 | $540 | 26 |
| SAML Response Reuse on hackerone.com/users/saml/authAnalysed#888930 | Valid | HackerOne | Authentication | Low | 2020-07-24 | – | 26 |
| Improper Authentication via previous backup code loginAnalysed#1485788 | Valid | Basecamp | Authentication | Medium | 2022-03-24 | – | 24 |
| Login form on non-HTTPS pageAnalysed#214571 | Valid | Rockstar Games | Cryptography | High | 2017-04-26 | $350 | 24 |
| Improper session managementAnalysed#737 | Valid | HackerOne | Authentication | – | 2014-02-19 | $100 | 24 |
| Cloudflare is not properly deleting user's accountAnalysed#1728292 | Valid | Cloudflare Public Bug Bounty | Input Validation and Logic | Medium | 2023-04-13 | – | 23 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.