From POST-Based XSS to Full Account Takeover
Medium2026-10-28
Web
Not rated
BUG BOUNTY WRITEUPS
Account takeover writeups
Full account takeover, usually by chaining smaller bugs: weak password reset flows, OAuth mistakes, token leaks and email-change logic.
89 reports and writeups from 2024 to 2026. 35 carry a severity from the disclosing platform, 27 of them rated High or Critical. Last updated 2026-10-30.
Latest Account takeover reports
Search and filter all writeupsWeb
Not rated
Web
Not rated
Web
Not rated
I Analyzed 12 IDOR-to-ATO Reports. The Email-Change Endpoint Wins.
InfoSec Write-ups2026-10-18
Web, API
Not rated
0-Click Account Takeover via Cookie Switching
Medium2026-10-13
Web
Not rated
Improper OTP Implementation to Full Account Takeover
InfoSec Write-ups2026-09-08
Web
Not rated
MariaDB GRANT PROXY permits unauthorized authentication changes and administrator account takeover
HackerOneMariaDB2026-09-07
Web
High
1-Click Account Takeover via Open Redirect through Regex Bypass in Domain Validation
HackerOneKhan Academy2026-06-20
Web
Critical
DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeover
HackerOneBasecamp2026-04-14
Web
High
No Rate Limiting on Password Attempts After Insecure Registration Flow cause ATO
HackerOneMars2026-02-24
Web
Medium
clickjacing can lead to account takeover
HackerOnepixiv2026-01-18$200 bounty
Web
Low
Account Takeover via Unverified Email Change and Improper Session Handling
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
Second-Order XSS via javascript protocol in MCP Server Portal Apps leads to ATO
HackerOneCloudflare Public Bug Bounty2025-12-16
Web, Cloud, AI
Low
DOM XSS to Account Takeover: not-so-dirty dancing in a GIS SDK
Researcher blog2025-12-07
Web
Not rated
Two click Account Takeover
HackerOneBasecamp2025-11-11
Web
High
Unauthorized Password Reset Allows Account Takeover Across Tenant Boundaries
HackerOnelemlist2025-11-07
Web
High
Account Takeover in Password Reset Function
HackerOneMars2025-09-02
Web
Critical
[CRITICAL] 0-Click Account Takeover via Password Reset [AUTH-3243] /orchestrator/v1/password_reset/start
HackerOneRemitly2025-07-21
Web
Critical
Account takeover of existing HackerOne accounts through SCIM provisioning
HackerOneHackerOne2025-07-17
Web
High
1 Click Account Takeover via Auth Token Theft on marketing.hostinger.com
HackerOnehostinger2025-06-06
Web
High
Puny-Code, 0-Click Account Takeover
Researcher blog2025-06-01
Web
Not rated
Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover )
HackerOneKhan Academy2025-05-07
Web
Critical
SSRF in Autodesk Rendering leading to account takeover
HackerOneAutodesk2025-03-18
Web
Critical
Account Takeover Vulnerability in Shopify Collabs Platform Due to Missing Email Verification
HackerOneShopify2025-03-11$800 bounty
Web
Low
Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)
HackerOneMTN Group2025-03-04
Web
Critical
Account Takeover via Password Reset without user interactions
HackerOneGitLab2025-02-26$35,000 bounty
Web
Critical
Unauthorized access to PII leads to Administrator account Takeover
HackerOneMTN Group2025-02-22
Web
Critical
CSRF leads to Account takeover
HackerOneU.S. Dept Of Defense2024-12-18
Web
High
CSRF Attack on changing security questions leads to full Account TakeOver
HackerOneU.S. Dept Of Defense2024-12-18
Web
High
CSRF leads to Account takeover
HackerOneU.S. Dept Of Defense2024-12-18
Web
High
Social media account takeover
HackerOneMTN Group2024-11-03
Web
Low
Lack of rate limiting in https://███/PKI/PassReset.aspx leads to PII disclosure and potential account takeover
HackerOneU.S. Dept Of Defense2024-10-25
Web
Critical
Host header injection leads to account takeover
HackerOneEnjin2024-10-15
Web
High
Account Takeover due to DNS Rebinding
Researcher blog2024-09-17
Web
Not rated
Interesting Story of an Account Takeover Vulnerability
Medium2024-09-12$2,000 bounty
Web
Not rated
Self-XSS to ATO via Site Features
Researcher blog2024-09-08
Web
Not rated
CSRF Bypass Using Domain Confusion Leads To ATO
InfoSec Write-ups2024-08-28$4,000 bounty
Web
Not rated
Instagram and Meta 2FA Bypass by Unprotected Backup Code Retrieval in Accounts Center
MediumMeta / Facebook2024-08-22$10,000 bounty
Web
Not rated
How 1 Exposed Honeywell API Gave us Control Over an Internal Engineering System
Researcher blogHoneywell2024-08-19
Web, API
Not rated
FULL ACCOUNT TAKEOVER
HackerOneMTN Group2024-08-17
Web
Critical
Forced SSO Session Fixation
InfoSec Write-ups2024-08-16
Web
Not rated
Account takeover on 8 years old public program
Medium2024-08-14
Web
Not rated
Bucket Monopoly: Breaching AWS Accounts Through Shadow Resources
Researcher blogAWS2024-08-09
Web, Cloud
Not rated
The Butterfly Effect: Turning Overlooked - Misconfigurations into Zero Click Account Takeover
Researcher blog2024-08-07
Web, API
Not rated
$500 for Cracking Invitation Code For Unauthorized Access & Account Takeover
InfoSec Write-ups2024-08-06$500 bounty
Web
Not rated
Account Takeover via Broken Authentication Workflow: Free Lifetime Streaming!
Researcher blog2024-08-01
Web
Not rated
Stealing First Party Access Token of Facebook Users: Meta Bug Bounty
MediumMeta / Facebook2024-07-30
Web
Not rated
Interesting Business Logic Error leads to Pre-Account Takeover via Verification bypass on GoogleVRP
MediumGoogle2024-07-30
Web
Not rated
Unlocking the Weak Spot: Exploiting Insecure Password Reset Tokens
Researcher blog2024-07-28
Web
Not rated
Unauth IDOR to mass account takeover without user interaction on the ███████ (https://███████.edu/)
HackerOneU.S. Dept Of Defense2024-07-19
Web
High
Account Takeover via Authentication Bypass in TikTok Account Recovery
HackerOneTikTok2024-07-13$12,000 bounty
Web
Critical
Reset the 2FA of the user which can lead to Account Takeover
HackerOneHackerOne2024-07-11
Web
Medium
0 Click account takeover via timed requests to ███████forgot-password (single-packet attack)
HackerOneMars2024-07-11
Web
High
$500 for Cracking Invitation Code For Unauthorized Access & Account Takeover
Medium2024-07-07$500 bounty
Web
Not rated
Self XSS + Login CSRF + OAuth = Account Takeover
Medium2024-07-02
Web
Not rated
Vulnerabilities In CocoaPods Open The Door To Supply Chain Attacks Against Thousands Of iOS And MacOS Applications
Researcher blogCocoaPods2024-07-01
iOS, Source Code, macOS
Not rated
Account Takeover / Arbitrary File read and deletion / Partial code execution (intent redirection)
HackerOneMercadoLibre2024-06-28
Android
High
Account takeover using reset password link
HackerOneMars2024-06-25
Web
Medium
Sign-in with World ID: XSS and ATO via OIDC Form Post Response Mode
Researcher blogTools for Humanity (Worldcoin)2024-06-19
Web
Not rated
[Meetup][World ID][OIDC] Insufficient Filtering of "state" Parameter in Response Mode form_post leads to XSS and ATO
HackerOneTools for Humanity2024-06-19
Web
Critical
Mobile OAuth Attacks - iOS URL Scheme Hijacking Revamped
GitHub2024-06-17
iOS
Not rated
Zoom Session Takeover - Cookie Tossing Payloads, OAuth Dirty Dancing, Browser Permissions Hijacking, and WAF abuse
GitHubZoom2024-06-07$15,000 bounty
Web
Not rated
Account takeover via insecure intent handling
HackerOneBasecamp2024-05-30
Android
Medium
How a Single Parameter Led to Two ATO Cases
Medium2024-05-18
Web
Not rated
Real World GitLab Account Take Over
Medium2024-05-04
Web
Not rated
How I was able to discover ATO Via IDOR vulnerability
Medium2024-04-28
Web
Not rated
Unsecured Content Provider leads to Account Takeover
Medium2024-04-20
Android
Not rated
Taking over accounts in multiple ways
Researcher blog2024-04-17
Web
Not rated
How we escalated a DOM XSS to a sophisticated 1-click Account Takeover for $8000 - Part 1
GitHub2024-04-06$8,000 bounty
Web
Not rated
Web
Not rated
Oauth Misconfiguration Leads to 0-Click ATO
Medium2024-04-02
Web
Not rated
OpenStack Admin Account Takeover due to Unsafe Environment Handling in MuranoPL
Researcher blogOpenstack2024-03-21
Web, Cloud
Not rated
FlowFixation: AWS Apache Airflow Service Takeover Vulnerability and Why Neglecting Guardrails Puts Major CSPs at Risk
Researcher blogAWS, Microsoft (Azure), Google (GCP)2024-03-21
Web, Cloud
Not rated
Security Flaws within ChatGPT Ecosystem Allowed Access to Accounts On Third-Party Websites and Sensitive Data
Researcher blogOpenAI (ChatGPT), PluginLab.AI, KesemAI2024-03-13
Web, AI
Not rated
Cross Window Forgery: A Web Attack Vector
Researcher blog2024-02-18
Web
Not rated
Account Takeover [It Looked Secure at First]
Medium2024-02-15
Web
Not rated
Hacking Microsoft and Wix with Keyboard Shortcuts
Researcher blogMicrosoft, Wix2024-02-15
Web
Not rated
CVE-2024-23724: Ghost CMS Stored XSS Leading to Owner Takeover
Researcher blogGhost2024-02-13
Web
Not rated
Null Byte on Steroids
Medium2024-02-06
Web
Not rated
ChatGPT Account Takeover - Wildcard Web Cache Deception
GitHubOpenAI (ChatGPT)2024-02-04$6,500 bounty
Web, AI
Not rated
IDOR to account takeover on POST to █████████ by changing member_id parameter
HackerOneMars2024-01-30
Web
Critical
Web
Not rated
Multiple Vulnerabilities On GestSup 3.2.44
Researcher blogGetSup2024-01-22
Web, Source Code
Not rated
Understanding GitLab EE/CE Account TakeOver (CVE-2023-7028)
Researcher blogGitLab2024-01-17
Web
Not rated
IDN Homograph Attack - Reborn of the Rare Case
Medium2024-01-12
Web
Not rated
XSS to OAuth access token leak in office online which can be used to account takeover
GitHubMicrosoft2024-01-12$500 bounty
Web
Not rated
How I was able to takeover any account (Zero-click ATO)
GitHub2024-01-06
Web
Not rated
Technical Advisory – Multiple Vulnerabilities in PandoraFMS Enterprise
Researcher blogPandoraFMS2024-01-02
Web
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.