Browse / Coinbase

Coinbase

See its reports on the map

Attack surface: 1,044 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Coinbase

• Misconfiguration20
• Authentication15
• Information Disclosure11
• Cross-Site Request Forgery7
• Other weaknesses7
• Business Logic5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Requestor Email Disclosure via Email NotificationInformativeInformation Disclosure · low
   13 votes
2. Coinbase Android Security VulnerabilitiesInformativeCryptographic Issues - Generic
   9 votes
3. coinbase Email leak while sending and requestingInformativeImproper Authentication - Generic · low
   6 votes
4. Content Injection error pageInformativeViolation of Secure Design Principles
   6 votes
5. Two-factor authentication (via SMS)InformativeImproper Authentication - Generic
   5 votes
6. 2FA settings allowed to be changed with no delay/freeze on fundsInformativeViolation of Secure Design Principles
   5 votes
7. Simultaneous Session Logon : Improper Session ManagementInformativeImproper Authentication - Generic
   4 votes
8. User Enumeration, Information Disclosure and Lack of Rate Limitation on APIInformativeViolation of Secure Design Principles
   4 votes
9. XXE in OAuth2 Applications gallery profile App logoInformativeXML External Entities (XXE)
   3 votes
10. Information Disclosure That shows the webroot of CoinBase ServerInformativeInformation Disclosure
    3 votes
11. Csrf bug on signup sessionInformativeCross-Site Request Forgery (CSRF)
    2 votes
12. Balance Manipulation - BUGInformative
    2 votes
13. IFRAME loaded from External Domains Informative
    2 votes
14. Cookie missing the HttpOnly flag InformativeMisconfiguration
    2 votes
15. Improper Validation of the Referrer header leading to Open URL RedirectionInformativeOpen Redirect
    2 votes
16. User provided values trusted in sensitive actionsInformativeInformation Disclosure
    1 votes
17. User provided values passed to PHP unset() functionInformativeType Confusion
    1 votes
18. New Device Confirmation BugInformative
    1 votes
19. X-Frame-OptionsInformativeUI Redressing (Clickjacking)
    1 votes
20. Information disclosure in coinbase android appInformativeImproper Authentication - Generic · low
    1 votes
21. Transaction Pending Via Ip Change InformativeUncontrolled Resource Consumption
    1 votes
22. Inaccurate Payment receipt InformativeBusiness Logic Errors
    1 votes
23. Runtime manipulation iOS app breaking the PINInformativeViolation of Secure Design Principles
    1 votes
24. iframes considered harmfulInformativeViolation of Secure Design Principles
    1 votes
25. Device confirmation FlawInformative
26. Potential for Double Spend via Sign Message UtilityInformativeCryptographic Issues - Generic