launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API
HackerOneBasecamp2026-10-30
Web, API
High
BUG BOUNTY WRITEUPS
API writeups
Bugs in REST and GraphQL APIs: broken object level authorization, mass assignment, excessive data exposure and rate limits.
194 reports and writeups from 2024 to 2026. 150 carry a severity from the disclosing platform, 48 of them rated High or Critical. Last updated 2026-10-30.
Latest API reports
Search and filter all writeupsWeb, API
Not rated
Web, API
Not rated
GraphQL Vulnerabilities: The Bug Class Most Hunters Still Don’t Know How to Test
Researcher blog2026-10-29
Web, API
Not rated
Practical Bug Bounty Hunting: Finding API Leaks, PII Exposure, and Password Reset Vulnerabilities
Medium2026-10-29
Web, API, AI
Not rated
Web, API
Not rated
Understanding BOLA in Spring Boot: From Vulnerable Endpoints to Ownership-Based Authorization
Medium2026-10-27
Web, API
Not rated
Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API
HackerOneNextcloud2026-10-27
Web, API, Cloud
Low
No password confirmation required when using apptoken on sensitive endpoint
HackerOneNextcloud2026-10-27
Web, API, Cloud
Medium
Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone
HackerOneNextcloud2026-10-27
Web, API, Cloud
Medium
Public shares remain accessible via alternate endpoints after owner account is disabled
HackerOneNextcloud2026-10-27$270 bounty
Web, API, Cloud
Medium
A disabled account's API key still works on BMO's Mojolicious /rest/ routes, including for security-group bugs filed after the disable
HackerOneMozilla2026-10-26$4,000 bounty
Web, API
High
Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints
HackerOneNode.js2026-10-23
Web, API
Medium
Web, API
Not rated
Deck app: Invalid tag color is accepted by API and breaks frontend UI
HackerOneNextcloud2026-10-20
Web, API, Cloud
Low
I Analyzed 12 IDOR-to-ATO Reports. The Email-Change Endpoint Wins.
InfoSec Write-ups2026-10-18
Web, API
Not rated
Mimari Yanılgılar: APIM Key Sızıntısı ve Kısıtlanmamış JWT İle Zafiyet Zinciri (Vulnerability…
Medium2026-10-14
Web, API
Not rated
Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint
HackerOneWordPress2026-10-12
Web, API
Critical
Client-Side Denial of Service (DoS) via Memory Exhaustion on Password Reset Endpoint
HackerOneKhan Academy2026-10-05
Web, API
High
IDOR allows user to access report details via reference.json endpoint
HackerOneHackerOne2026-10-01$15,000 bounty
Web, API
Critical
Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████
HackerOneEssity2026-09-18
Web, API
Critical
Socket API drops expired timeouts for transfers queued behind a connection limit
HackerOnecurl2026-09-18
Web, API
Not rated
Team membership information returned on API level based on ID
HackerOneNextcloud2026-09-17$200 bounty
Web, API, Cloud
Low
Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups
HackerOneNextcloud2026-09-17
Web, API, Cloud
Medium
Arbitrary Board Preference Injection via Deck Config API
HackerOneNextcloud2026-09-17$200 bounty
Web, API, Cloud
Medium
Unauthenticated testing endpoint of notify_push expose internal IP
HackerOneNextcloud2026-09-05$150 bounty
Web, API, Cloud
Medium
API token sent to URL dictated by an untrusted project .weblate file
HackerOneWeblate2026-09-04
Web, API
Medium
Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)
HackerOneNode.js2026-08-28
Web, API
Medium
Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint
HackerOneIBM2026-08-28
Web, API
Not rated
Critical SQL Injection WDM API (████████)
HackerOneEssity2026-08-27
Web, API
Critical
URL API: triple-slash parses path segment as hostname
HackerOnecurl2026-08-07
Web, API
Medium
Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)
HackerOneMozilla2026-08-05$12,000 bounty
Web, API
Critical
Non-Production API Endpoints for the Amazon Cloudwatch Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2026-07-27
Web, API, Cloud
Medium
connect.8x8.com/api/v1: JWT Algorithm Confusion Vulnerability
HackerOne8x82026-07-22$1,337 bounty
Web, API
High
bedrock-mantle.api.aws accepts Bedrock API keys outside the IAM Deny, CloudTrail signal, and invocation logging AWS publishes for Bedrock keys
HackerOneAWS VDP2026-07-14
Web, API, Cloud
Medium
Yelp for Business: locked Email field silently editable via API
HackerOneYelp2026-07-02
Web, API
Medium
jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`
HackerOne8x82026-07-02$100 bounty
Web, API
Low
Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2026-07-02
Web, API, Cloud
Medium
Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint
HackerOneDiscourse2026-06-30$1,024 bounty
Web, API
High
libcurl upload read callbacks miss recursive API guard, allowing prohibited multi API reentry and ASAN-confirmed UAF
HackerOnecurl2026-06-30
Web, API
Low
Permission Model bypass via FileHandle.utimes() in the promises API
HackerOneNode.js2026-06-25
Web, API
Low
XML‑RPC login leak exposes valid session ID enabling unauthorized API access
HackerOneRevive Adserver2026-06-25
Web, API
Medium
Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql
HackerOneHackerOne2026-06-17$7,000 bounty
Web, API
High
Malicious Conflux Endpoint Can Leave Stale Global OOO Queue Accounting After Teardown
HackerOneTor2026-06-16$100 bounty
Web, API
Low
Session ID reuse allowing XML‑RPC API authentication bypass
HackerOneRevive Adserver2026-06-03
Web, API
Medium
Blind POST SSRF via Web Push Notification Endpoint
HackerOnephpBB2026-05-30
Web, API
Medium
HMAC signature verification omits endpoint and payload allowing request forgery on CoinMate API
HackerOneCoinMate.io2026-05-20
Web, API
Low
POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)
HackerOneCoinMate.io2026-05-20
API, Web3
Medium
NULL pointer dereference in libcurl URL API redirect_url() with CURLU_DEFAULT_SCHEME
HackerOnecurl2026-05-17
Web, API
Not rated
Private circle can be added to another circle via API despite visibility restriction
HackerOneNextcloud2026-05-08$150 bounty
Web, API, Cloud
Low
Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumption
HackerOnePortSwigger Web Security2026-05-05$200 bounty
Web, API
Low
RBAC bypass on App log endpoints via `permissionRequired` typo — any authenticated user reads admin-only Enterprise App logs
HackerOneRocket.Chat2026-04-23
Web, API
Medium
DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API
HackerOneHackerOne2026-04-16
Web, API
Not rated
BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data
HackerOneNextcloud2026-04-14
Web, API, Cloud
Medium
Unauthenticated SSRF via Public Reference API -Sharing Token Bypass
HackerOneNextcloud2026-03-31
Web, API, Cloud
Not rated
Access to Deactivated LinkedIn Company Pages via Competitor Analytics API
HackerOneLinkedIn2026-03-24
Web, API
Medium
SQL Injection vulnerability found on ibm.com endpoint
HackerOneIBM2026-03-12
Web, API
Critical
Publicly accessible `█████████` endpoint exposing internal user identifiers and email addresses
HackerOneMars2026-02-24
Web, API
Medium
Sensitive information exposed at [███] via /export_panelists_to_xlsx endpoint
HackerOneMars2026-02-24
Web, API
Medium
Unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion
HackerOneNode.js2026-02-23
Web, API
Not rated
Internal logs/info leaked via endpoint {https://203.137.128.240/server-status}
HackerOnepixiv2026-01-20
Web, API
High
Reflected XSS Vulnerability in SSL VPN Endpoint — CVE-2025-0133
HackerOneU.S. Dept Of Defense2026-01-12
Web, API
Medium
Reflected XSS via user Parameter on getconfig.esp Endpoint
HackerOneU.S. Dept Of Defense2026-01-12
Web, API
Medium
Information Disclosure in API Endpoint /users
HackerOneU.S. Dept Of Defense2026-01-12
Web, API
Low
Publicly Accessible CDN Endpoint Exposing XML Metadata (including ETag)
HackerOneU.S. Dept Of Defense2026-01-12
Web, API
Low
Reflected XSS via user parameter on getconfig.esp endpoint
HackerOneU.S. Dept Of Defense2026-01-12
Web, API
Medium
[Critical Data Breach] Exposure of PII Data Leak via API Response
HackerOneU.S. Dept Of Defense2026-01-12
Web, API
Critical
Path Traversal vulnerability identified on IBM endpoint.
HackerOneIBM2026-01-12
Web, API
High
SQL injection identified on IBM endpoint.
HackerOneIBM2026-01-07
Web, API
Critical
Non-Production API Endpoints for the AI Ops Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2026-01-06
Web, API, Cloud
Medium
AWS Auto Scaling Service Reporting "AWS Internal" for CloudTrail Events Generated from Specific Endpoints
HackerOneAWS VDP2026-01-05
Web, API, Cloud
Medium
Remote Code Execution identified on IBM endpoint.
HackerOneIBM2025-12-31
Web, API
Critical
Unauthenticated GraphQL access by prepending __schema to private operations
HackerOneEnjin2025-12-05$500 bounty
Web, API
Medium
[my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to Zapier
HackerOneStripo Inc2025-12-01
Web, API
Critical
Authentication Bypass in Subscription Management Endpoint
HackerOnelemlist2025-11-17
Web, API
Critical
Blockstack Browser For Mac leaks "Core API Password" to 3rd parties
HackerOneHiro2025-10-31
Web, API
Low
Race condition on global `gss_context` during SOCKS5 GSS-API negotiation in libcurl
HackerOnecurl2025-09-26
Web, API
Medium
GraphQL Introspection Enabled on Shopify API Endpoint (Intended Behavior)
HackerOneShopify2025-09-17
Web, API
Not rated
Critical Information Disclosure via /talos/api/v1/files/upload
HackerOneBykea2025-09-17
Web, API
Critical
MongoDB Query Logs & Schema Leak via Unauthenticated Endpoint
HackerOneBykea2025-09-17
Web, API
Low
Stored XSS on TikTok's backend leads to the leakage of highly sensitive administrator data (Cookies, API Keys, Internal Paths, Emails, phone numbers).
HackerOneTikTok2025-09-11
Web, API
Medium
Email verification bypass via request to endpoint "accounts.insightly.com/signup/provisionuser"
HackerOneInsightly2025-08-18
Web, API
Critical
█.8x8.vc/index.js: Exposed Google Maps API Key Allowing Potential Abuse of Paid Services
HackerOne8x82025-08-14$500 bounty
Web, API
Medium
API Key Exposed in JavaScript File on 1Password Developer Site
HackerOne1Password - Enterprise Password Manager2025-07-18
Web, API
Not rated
Banned user still has access to their deleted account via HackerOne's API using their API key
HackerOneHackerOne2025-07-14
Web, API
Medium
Information disclosure identified on IBM endpoint.
HackerOneIBM2025-07-08
Web, API
Medium
Unauthorized Access to Private Video Description via Translation API for Private Accounts
HackerOneTikTok2025-06-27
Web, API
Low
IDOR on in-app hardcoded zombie endpoint
HackerOneBykea2025-06-13
Web, API
Medium
ImageId Format Injection in Image Upload Endpoint
HackerOneLichess2025-06-06
Web, API
Medium
Server-Side Request Forgery (SSRF) via Game Export API
HackerOneLichess2025-06-03
Web, API
Critical
Non-Production API Endpoint for the EventBridge Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Non-Production API Endpoints for the Health Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Non-Production API Endpoints for the bedrock Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Non-Production API Endpoints for the bedrock-agent Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Amazon Pinpoint SMS and Voice, version 2 Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Non-Production API Endpoints for the Global Accelerator Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Amazon Kendra Intelligent Ranking Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Non-Production API Endpoints for the Route 53 Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-27
Web, API, Cloud
Medium
Customer Data Exposure via Insecure Endpoint of coupon
HackerOneMars2025-05-27
Web, API
Medium
Non-Production API Endpoints for the Neptune Graph Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-27
Web, API, Cloud
Medium
user api key leaked
HackerOneWakaTime2025-05-13
Web, API
Not rated
Users Data Exposure via Insecure Endpoint
HackerOneMars2025-05-12
Web, API
Medium
`/names.nsf` and all `/names*` files route to public API on rubygems.org
HackerOneRubyGems2025-05-03
Web, API
Not rated
Broken Access Control Exposes Email Verification Status and Privacy Settings via API Endpoint
HackerOneWakaTime2025-04-29
Web, API
Low
Information disclosure on IBM training service endpoint
HackerOneIBM2025-04-29
Web, API
Not rated
Non-Production API Endpoints for the cloudwatch Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-04-25
Web, API, Cloud
Medium
Non-Production API Endpoint for the ElastiCache Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-04-25
Web, API, Cloud
Medium
Non-Production API Endpoints for the Glue Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-04-25
Web, API, Cloud
Medium
Privilege Escalation in Edit and Create Secret Endpoints Leads to Unauthorized Secret Modification
HackerOneDust2025-04-24
Web, API
High
Non-Production API Endpoints for the ssm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-04-24
Web, API, Cloud
Medium
(Part 2) Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-04-08
Web, API, Cloud
Medium
The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present
HackerOneHackerOne2025-04-01
Web, API
Critical
Non-Production API Endpoints for the Forecast Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-03-24
Web, API, Cloud
Medium
Django Debug Mode Enabled - Information Disclosure on api.wwm-dev.autodesk.com
HackerOneAutodesk2025-03-18
Web, API
Medium
Non-Production API Endpoints for the DocumentDB Elastic Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-03-11
Web, API, Cloud
Medium
Sensitive API Key Leakage
HackerOneAWS VDP2025-03-04
Web, API, Cloud
Medium
Non-Production API Endpoints for the Device Farm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-03-04
Web, API, Cloud
Medium
Broken Access Control leads to disclosure of transaction history via /v2/rechargeTransactionHistory endpoint
HackerOneMTN Group2025-03-02
Web, API
High
Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-02-26
Web, API, Cloud
Medium
Amazon Comprehend Medical Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints
HackerOneAWS VDP2025-02-25
Web, API, Cloud
Medium
Insecure Direct Object Reference (IDOR) in GraphQL deleteProfileImages Mutation
HackerOneAutodesk2025-02-21
Web, API
High
Unauthenticated API Access Exposing Premium Content and Financial Data
HackerOneXVIDEOS2025-02-09
Web, API
Not rated
API Data Leakage Vulnerability Report - `xvcams.com`
HackerOneXVIDEOS2025-02-09
Web, API
Not rated
XSS on using the legacy "Graphie To Png" API
HackerOneKhan Academy2025-02-06
Web, API
Critical
Weak credentials found in Jenkins endpoint
HackerOneIBM2025-02-05
Web, API
Critical
There is a POST based CSRF issue over IBM endpoint leading to modification of contact information.
HackerOneIBM2025-02-04
Web, API
Medium
Unauthorized Access to TikTok Account [Private Videos] via API Endpoint
HackerOneTikTok2025-01-24
Web, API
Medium
POST based Cross-Site Scripting on IBM research endpoint
HackerOneIBM2025-01-23
Web, API
Medium
Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`
HackerOneHackerOne2025-01-21$25,000 bounty
Web, API
Critical
Lack of Rate Limiting on Account Creation Endpoint
HackerOneXVIDEOS2025-01-16$200 bounty
Web, API
Low
Yet Another OTP code Leaked in the API Response
HackerOneMTN Group2025-01-08
Web, API
Critical
OTP code Leaked in API Response
HackerOneMTN Group2025-01-08
Web, API
Critical
Sensitive data exposure via /secure/███████ endpoint on ████████
HackerOneU.S. Dept Of Defense2024-12-18
Web, API
Medium
Exposed Logs and Bearer Tokens on Test Endpoint
HackerOneIBM2024-12-12
Web, API
Not rated
Insecure API Response Leads to Disclosure of Hashed Passwords
HackerOneMars2024-11-26
Web, API
Medium
Api data leak
HackerOnePlanet Labs2024-11-20
Web, API
Medium
Information disclosure on password cancel endpoint
HackerOneMozilla2024-10-29
Web, API
Low
paypal client_id And stripe api key indexed on web archive
HackerOneMozilla2024-10-18
Web, API
Not rated
Circular based introspetion Query leading to single request denial of service and cost consumption and query cost on api.sorare.com/graphql
HackerOneSorare2024-10-17
Web, API
Medium
Timeline API returns private post when target of a push notification
HackerOneAutomattic2024-10-17
Web, API
Low
Race Condition on Create API Function
HackerOneEnjin2024-10-15
Web, API
Not rated
User API Key leakage in Github commit leads to unauthorized access to sql.telemetry.mozilla.org
HackerOneMozilla2024-10-08
Web, API
High
Sauce Labs API key unencrypted in an old commit
HackerOneRuby on Rails2024-10-08
Web, API
Medium
SSRF and secret key disclosure found on Turbonomic endpoint
HackerOneIBM2024-09-19
Web, API
High
SSRF and secret key disclosure found on Turbonomic endpoint
HackerOneIBM2024-09-19
Web, API
High
RC Between GitHub's Repo Update REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access Retention
HackerOneGitHub2024-09-17
Web, API, Source Code
Medium
Escalating From Reader To Contributor In Azure API Management
Researcher blogMicrosoft (Azure)2024-09-13
Web, API, Cloud
Not rated
Private data related to program exposed via /reports/ .json endpoint to external user participant
HackerOneHackerOne2024-08-30
Web, API
Medium
Cross-site Scripting (XSS) - Reflected on https://api.mtn.sd/carbon/admin/login.jsp via `msgId` parameter - CVE-2020-17453
HackerOneMTN Group2024-08-24
Web, API
Medium
Authorization bypass due to cache misconfiguration
Medium2024-08-21$2,000 bounty
Web, API
Not rated
Showing the 150 most recent of 194. See all in the searchable index.
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.