Browse / Airbnb

Airbnb

See its reports on the map

Attack surface: 7,152 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Airbnb

• Information Disclosure3
• Cross-site Scripting2
• Injection and Smuggling1
• Authentication1
• Business Logic1
• Cross-Site Request Forgery1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. [m.airbnb.com] CRLF InjectionHTTP Response Splitting · low
   $2,50037 votes
2. ████ discloses valid Airbnb SSO login names via Google Search ResultsInformation Disclosure
   21 votes
3. I Can Delete Any Airbnb Users Symbol!Improper Authentication - Generic
   5 votes
4. authenticity_token is not random across page loadsCross-Site Request Forgery (CSRF)
   4 votes
5. Vulnerability type xss uncovered in airbnb.esCross-site Scripting (XSS) - Generic
   4 votes
6. SSL IssuesCryptographic Issues - Generic
   3 votes