Browse / Chaturbate

Chaturbate

See its reports on the map

Attack surface: 23,056 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Chaturbate

• Cross-site Scripting8
• Access Control7
• Authentication6
• Business Logic6
• Cross-Site Request Forgery6
• Information Disclosure5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Passive stored XSS at broadcast roomCross-site Scripting (XSS) - Stored · high
   74 votes
2. Reflected XSS on secure.chaturbate.comCross-site Scripting (XSS) - Reflected · high
   $80069 votes
3. Account Takeover via billingImproper Authorization · critical
   $8,00056 votes
4. Open redirection at https://chaturbate.com/auth/login/Open Redirect · low
   55 votes
5. Blind SSRF at https://chaturbate.com/notifications/update_push/Server-Side Request Forgery (SSRF) · high
   54 votes
6. Forget password link not expiring after email change.Improper Authorization · medium
   46 votes
7. The auto login link does not expire on changing email idImproper Access Control - Generic · low
   45 votes
8. CSS Injection on /embed/ via bgcolor parameter leaks user's CSRF token and allows for XSS Cross-site Scripting (XSS) - DOM · high
   43 votes
9. DoS attacks utilizing camo.stream.highwebmedia.comUncontrolled Resource Consumption · medium
   $40041 votes
10. Stored XSS in chat topic due to insecure emoticon parsing on any message typeCross-site Scripting (XSS) - Stored · medium
    $45033 votes
11. View Failed Approval and Pending videos other userslow
    $20028 votes
12. Web cache deception attack - expose token informationInformation Disclosure · medium
    28 votes
13. Rate limit missing at room loginImproper Restriction of Authentication Attempts · medium
    $50028 votes
14. Open redirect on chaturbate.com (tipping/purchase_success)Open Redirect · low
    $25026 votes
15. Camo Image Proxy Bypass with CSS Escape SequencesImproper Neutralization of Escape, Meta, or Control Sequences · low
    25 votes
16. Update Chat Allowed By Option ( without age verification )Business Logic Errors · low
    23 votes
17. Missing Rate Limitation at /apps/upload_app/ Business Logic Errors · low
    21 votes
18. Missing Rate Limitation at /photo_videos/photoset/createBusiness Logic Errors · low
    20 votes
19. No rate limiting in changing room subject.Improper Restriction of Authentication Attempts · low
    19 votes
20. Stored XSS on chaturbate.com (wish list)Cross-site Scripting (XSS) - Stored · low
    $10018 votes
21. [chaturbate.com] - CSRF Vulnerability on image uploadCross-Site Request Forgery (CSRF) · medium
    $30017 votes
22. Chaturbate "/chat_ignore_list/" endpoint does not check for Account status: Disabled before adding Ignore via POSTBusiness Logic Errors · low
    16 votes
23. Form Replay in customer information formInsufficiently Protected Credentials · medium
    16 votes
24. Unrestricted POST request size on roomlogin endpointUncontrolled Resource Consumption · low
    $20015 votes
25. No rate limiting in starting up a bot.Improper Restriction of Authentication Attempts · low
    15 votes
26. No rate limit in stats api token endpointImproper Restriction of Authentication Attempts · low
    15 votes
27. Login form on non-HTTPS page on http://stream.highwebmedia.com/auth/login/Cleartext Transmission of Sensitive Information · low
    15 votes
28. CSRF on change video thumbnail at https://chaturbate.comCross-Site Request Forgery (CSRF) · low
    14 votes
29. No rate limit in affiliate statsapi endpointImproper Restriction of Authentication Attempts · low
    14 votes
30. CSV Injection with the CSV export featureOS Command Injection · low
    14 votes
31. [chatws25.stream.highwebmedia.com] - Reflected XSS in c parameterCross-site Scripting (XSS) - Reflected · medium
    $35013 votes
32. Bypass subdomain limits using race conditionTime-of-check Time-of-use (TOCTOU) Race Condition · low
    $10013 votes
33. Users may still able to view chat room panel of password protected roomsImproper Access Control - Generic · medium
    13 votes
34. Password protected rooms total number of viewers disclosure to unauthorized membersInformation Disclosure · low
    11 votes
35. Private and group tokens per minute endpoint active for disabled usersImproper Access Control - Generic · low
    $15011 votes
36. Add non-existent room moderatorImproper Input Validation · low
    11 votes
37. Homograph attack on redirect URL (https://chaturbate.com/external_link/?url)Violation of Secure Design Principles · low
    11 votes
38. Open redirect in securegatewayaccess.com / secure.chaturbate.com via prejoin_data parameterOpen Redirect · medium
    $25010 votes
39. CSRF in REPORT EMOTICON featureCross-Site Request Forgery (CSRF) · low
    $25010 votes
40. Blind SSRF on image proxy camo.stream.highwebmedia.comServer-Side Request Forgery (SSRF) · medium
    10 votes
41. Stored XSS against all Chaturbate users using an application nameCross-site Scripting (XSS) - Stored · medium
    10 votes
42. Homograph attack on redirect URL Violation of Secure Design Principles · low
    9 votes
43. Unrestricted POST request size on /customer_support/information_form/ endpointViolation of Secure Design Principles · low
    8 votes
44. Stats Token doesn't expire after deactivating accountImproper Access Control - Generic · low
    $2508 votes
45. CSRF in cancel group and private show requestsCross-Site Request Forgery (CSRF) · medium
    $3007 votes
46. Reflected XSS on ssl-ccstatic.highwebmedia.com via player.swfCross-site Scripting (XSS) - Reflected · medium
    7 votes
47. CSRF in "send them an email and browser notification" featureCross-Site Request Forgery (CSRF) · low
    $1506 votes