💸 Top 10 biggest bounties ever paid on HackerOne

Publicly disclosed. Real payouts. One bug each 👇

🥇 $50,000 — Shopify
GitHub access token exposure · augustozanellato

🥈 $39,999 — Uber
API access · tomnomnom

🥉 $35,000 — GitLab
Account takeover via password reset · asterion04

4️⃣ $33,510 — GitLab
RCE via GitHub import · vakzz

5️⃣ $30,000 — PayPal
Dependency confusion RCE · alexbirsan

6️⃣ $29,000 — GitLab
Arbitrary file read · vakzz

7️⃣ $25,000 — Valve
SQL injection in report_xml.php · moskowsky

8️⃣ $25,000 — Snapchat
Exposed Kubernetes API → RCE · txt3rob

9️⃣ $25,000 — HackerOne
Disclosing a private program · haxta4ok00

🔟 $20,160 — X / xAI
Pre-auth RCE · orange

💡 And these are just the public ones — the biggest private bounties go way higher.

Which one surprises you most? 🤯

Restricted RPC leaks alternative block hashes via /get_alt_blocks_hashes

🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Monero
🔹 Reported By: int0ha_
🔹 State: 🟢 Resolved
🔹 Disclosed: July 20, 2026, 12:15am (UTC)
🐞 Source: HackerOne

The `/get_alt_blocks_hashes` RPC endpoint was restricted to prevent unintended access to alternative block hashes. The endpoint had previously been unrestricted.

👉 Read full report

Blind Enumeration of Private Card Names via Sort Oracle and ID Discovery

🔹 Severity: Low
🔹 Reported To: Trello
🔹 Reported By: BobAshEf
🔹 State: 🟢 Resolved
🔹 Disclosed: July 20, 2026
🐞 Source: Bugcrowd

👉 Read full report

Public Google Maps API key on www.globe.gov allows Geocoding API calls (billable use)

🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: madhu873
🔹 State: ⚪️ Informational
🔹 Disclosed: July 21, 2026
🐞 Source: Bugcrowd

👉 Read full report

OAuth redirect uri validation bypass for :proxima_first_party_sync apps

🔹 Severity: High
🔹 Weakness: Open Redirect
🔹 Reported To: GitHub
🔹 Reported By: ahacker1
🔹 State: 🟢 Resolved
🔹 Disclosed: July 21, 2026, 9:43pm (UTC)
🐞 Source: HackerOne

A vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. The vulnerability was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. The vulnerability was reported through the GitHub Bug Bounty program.

👉 Read full report

connect.8x8.com/api/v1: JWT Algorithm Confusion Vulnerability

🔹 Severity: High | 💰 1,337 USD
🔹 Weakness: Improper Verification of Cryptographic Signature
🔹 Reported To: 8x8
🔹 Reported By: kyotozzx
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026, 4:15am (UTC)
🐞 Source: HackerOne

A JWT algorithm confusion vulnerability was reported in the `v1` API of `connect.8x8.com`. The JWT verifier did not enforce algorithm pinning and would accept HS256 tokens signed with the RSA public key used as an HMAC secret. The issue was remediated by enforcing RS256 algorithm pinning in the `v1` API verifier.

👉 Read full report

GitHub user to server tokens can create issues in any public repository

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: GitHub
🔹 Reported By: ahacker1
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026, 7:39pm (UTC)
🐞 Source: HackerOne

A vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. The authorization check only verified that the installation had read permissions on the target repository rather than verifying that the token's installation was explicitly granted access to…

👉 Read full report

AWS *.a2z.com | Unauthenticated Clickhouse UI : Database access + SSRF

🔹 Severity: High
🔹 Weakness: Authentication Bypass
🔹 Reported To: AWS VDP
🔹 Reported By: notnotnotveg
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026, 7:53pm (UTC)
🐞 Source: HackerOne

👉 Read full report

Identity Theft via Broken Link Hijacking on NASA Astronaut News Release Page

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: muhammadabdillah64edc3
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd

👉 Read full report

Arbitrary External Redirect Through SAML RelayState After Successful Authentication

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: 2yuk
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd

👉 Read full report

Blind SQL Injection in Search Functionality Leads to Full Database Extraction

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: molany
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd

👉 Read full report

Exposed Credentials in Public .env File on NASA Git Repository

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Hunt3rboy
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd

👉 Read full report

Critical Authentication Bypass via Path Normalization (Double Slash) on Live NASA MODAPS OKAPI Production Instance

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: marcelojr
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd

👉 Read full report

RE : Host Header Injection leads to Cookie Domain Manipulation on sealevel.nasa.gov

🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: sanjay910
🔹 State: ⚪️ Informational
🔹 Disclosed: July 23, 2026
🐞 Source: Bugcrowd

👉 Read full report

Reflected XSS and HTML Injection on cce-signin.gsfc.nasa.gov via 'popup_flag' parameter

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: ItsS4LEH
🔹 State: 🟢 Resolved
🔹 Disclosed: July 23, 2026
🐞 Source: Bugcrowd

👉 Read full report

Data-Sculptor CSV expression evaluation leads to backend RCE, Kubernetes serviceaccount token disclosure, and authenticated Kubernetes control-plane access

🔹 Severity: High
🔹 Reported To: Atlassian
🔹 Reported By: MononcleMich
🔹 State: 🟢 Resolved
🔹 Disclosed: July 23, 2026
🐞 Source: Bugcrowd

👉 Read full report

ZMQ RPC Log Injection and Untrusted Payload Persistence

🔹 Severity: Medium
🔹 Weakness: CRLF Injection
🔹 Reported To: Monero
🔹 Reported By: redlobsterzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: July 24, 2026, 7:19pm (UTC)
🐞 Source: HackerOne

A vulnerability was reported in the Monero CLI daemon where the ZMQ RPC request path logs untrusted request content before semantic validation. This allowed a remote party with access to the ZMQ endpoint to inject newline and control-character content into daemon logs, enabling log forging. The vulnerability was introduced in commit 77986023c3 and affected releases from v0.12.0.0 through v0.18.4.6, as well as the…

👉 Read full report

Authentication Bypass via XML Signature Wrapping in SAML SSO

🔹 Severity: Critical
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Rocket.Chat
🔹 Reported By: 0jayden
🔹 State: 🟢 Resolved
🔹 Disclosed: July 27, 2026, 4:37pm (UTC)
🐞 Source: HackerOne

The SAML SSO implementation in Rocket.Chat verified XML signatures but did not bind the validated signature to the `samlp:Response` or `saml:Assertion`. As a result, an attacker could submit a wrapped document carrying forged identity attributes alongside a valid signature made by the trusted IdP certificate, and gain unauthorized access to the system.

👉 Read full report

Non-Production API Endpoints for the Amazon Cloudwatch Fails to Log to CloudTrail Resulting in Silent Permission Enumeration

🔹 Severity: Medium
🔹 Weakness: Insufficient Logging
🔹 Reported To: AWS VDP
🔹 Reported By: nick_frichette_dd
🔹 State: 🟢 Resolved
🔹 Disclosed: July 27, 2026, 7:51pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Amazon CloudWatch service, where certain non-production API endpoints could be used to perform permission enumeration without generating corresponding CloudTrail events. This allowed for silent testing of compromised IAM credentials. The vulnerability was reported to AWS, which acknowledged it as a security issue. Specific endpoints and operations that exhibited this behavior…

👉 Read full report

Sandbox User Can Inject Rogue CA Certificate into OS Trust Store via Sudo-Allowed deploy-certificates.sh

🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: AWS VDP
🔹 Reported By: mistercloudsec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 28, 2026, 3:29pm (UTC)
🐞 Source: HackerOne

A vulnerability was found in the Bedrock AgentCore Code Interpreter sandbox. The sandbox granted a user passwordless sudo access to a script that deployed certificates to the OS trust store. An attacker could have generated a rogue CA certificate, placed it in a writable directory, and then used the sudo-allowed script to inject the rogue CA into the trust store. This could have been used to perform…

👉 Read full report