Web
Not rated
BUG BOUNTY WRITEUPS
2FA and OTP bypass writeups
Getting past two-factor and one-time codes: missing rate limits, codes leaked in responses, response manipulation and fallback flows.
41 reports and writeups from 2024 to 2026. 25 carry a severity from the disclosing platform, 9 of them rated High or Critical. Last updated 2026-10-30.
Latest 2FA and OTP bypass reports
Search and filter all writeupsBypassing OTP Verification by Modifying the Server Response
Medium2026-10-19
Web
Not rated
Web
Not rated
Improper OTP Implementation to Full Account Takeover
InfoSec Write-ups2026-09-08
Web
Not rated
Adding phone number to profile By OTP brute forcing
HackerOneCoinMate.io2026-08-08$100 bounty
Web
Medium
2FA requirement bypass when inviting team members
HackerOneOmise2026-02-28
Web
Medium
2FA Bypass via Response Manipulation on Login Page
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
2FA bypass possible on https://authsvc.singlestore.com
HackerOneSingleStore2025-10-22
Web
Medium
Business Logic Error – Bypass of OTP Verification During Signup on hover.com
HackerOneTucows (VDP)2025-09-02
Web
Not rated
Enable 2FA without verifying the email
HackerOneXVIDEOS2025-05-09
Web
Low
2FA Bypass leads to impersonation of legimate users
HackerOneDrugs.com2025-03-14
Web
High
Yet Another OTP code Leaked in the API Response
HackerOneMTN Group2025-01-08
Web, API
Critical
OTP code Leaked in API Response
HackerOneMTN Group2025-01-08
Web, API
Critical
Bypassing HackerOne 2FA due to race condition
HackerOneHackerOne2024-10-30
Web
Medium
No rate limit in OTP code sending
HackerOneMTN Group2024-10-21
Web
Medium
Change phone number OTP flaw leads to any phone number takeover
HackerOneinDrive2024-10-09$2,000 bounty
Web
Critical
When Certificates Fail: A Story of Bypassed MFA in Remote Access
GitHub2024-09-09
Web
Not rated
Instagram and Meta 2FA Bypass by Unprotected Backup Code Retrieval in Accounts Center
MediumMeta / Facebook2024-08-22$10,000 bounty
Web
Not rated
$1600 Bounty on a Main Domain
Medium2024-08-18$1,600 bounty
Web
Not rated
2FA Bypass - IDN Mischief
Medium2024-08-15
Web
Not rated
How I Got $150 on HackerOne for My First Bug
Medium2024-08-12$150 bounty
Web
Not rated
Bypassing 2FA with conventional session management - open.rocket.chat
HackerOneRocket.Chat2024-08-10
Web
Low
$500 for Cracking Invitation Code For Unauthorized Access & Account Takeover
InfoSec Write-ups2024-08-06$500 bounty
Web
Not rated
Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FA
HackerOneHackerOne2024-07-11
Web
Medium
Reset the 2FA of the user which can lead to Account Takeover
HackerOneHackerOne2024-07-11
Web
Medium
Two-factor authentication bypass lead to information disclosure about the program and all hackers participate
HackerOneHackerOne2024-07-11
Web
High
2FA requirement bypass when claiming bounty
HackerOneHackerOne2024-07-11
Web
Not rated
Improper Authentication - 2FA OTP Reusable
HackerOneHackerOne2024-07-11
Web
High
2FA Bypass via Leaked Cookies
HackerOneHackerOne2024-07-11
Web
Medium
Bypassing Two-Factor Authentication via Account Deactivation and Password Reset
HackerOneHackerOne2024-07-11
Web
Not rated
Business Logic error leads to bypass 2FA requirement
HackerOneHackerOne2024-07-11
Web
High
Session Not Expire / 2FA Bypass
HackerOneHackerOne2024-07-11
Web
Medium
Two factor authentication bypass
HackerOneHackerOne2024-07-11
Web
Medium
Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program
HackerOneHackerOne2024-07-11
Web
Low
Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery
HackerOneHackerOne2024-07-11
Web
Critical
2fa can't be activated on app.pullrequest.com
HackerOneHackerOne2024-07-11
Web
Not rated
$500 for Cracking Invitation Code For Unauthorized Access & Account Takeover
Medium2024-07-07$500 bounty
Web
Not rated
Account deletion using the /v1/account/destroy API endpoint using account password without 2FA verification
HackerOneMozilla2024-06-17$1,000 bounty
Web, API
Medium
Email OTP/2FA Bypass
HackerOneDrugs.com2024-06-16
Web
Critical
Session Doesn't expire after 2fa and also other session can change passsword
HackerOneSideFX2024-03-02$300 bounty
Web
Low
500$: MFA bypass By Race Condition
Medium2024-01-28$500 bounty
Web
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.