Browse / Coinbase

Coinbase

See its reports on the map

Attack surface: 1,044 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Coinbase

• Misconfiguration20
• Authentication15
• Information Disclosure11
• Cross-Site Request Forgery7
• Other weaknesses7
• Business Logic5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Double Payout via PayPalBusiness Logic Errors · critical
   $10,000324 votes
2. Ethereum account balance manipulationBusiness Logic Errors · critical
   276 votes
3. ETH contract handling errorsBusiness Logic Errors · critical
   208 votes
4. HTML injection in apps user review Cross-site Scripting (XSS) - Generic
   $20031 votes
5. Authentication IssuePrivilege Escalation · low
   $20027 votes
6. [buy.coinbase.com]Content InjectionViolation of Secure Design Principles · low
   26 votes
7. Captcha Bypass in Coinbase SignUp FormViolation of Secure Design Principles · low
   $10023 votes
8. Bypassing 2FA for BTC transfersImproper Authentication - Generic
   $1,00018 votes
9. Prepopulation of email address and name leaks information provided to other merchantsUI Redressing (Clickjacking)
   16 votes
10. OAuth authorization page vulnerable to clickjackingImproper Authentication - Generic
    16 votes
11. Stored CSS InjectionResource Injection
    15 votes
12. XSSI (Cross Site Script Inclusion)Cross-Site Request Forgery (CSRF)
    15 votes
13. Coinbase Android Application - Bitcoin Wallet Leaks OAuth Response CodeInformation Disclosure
    14 votes
14. Stored-XSS in https://www.coinbase.com/Cross-site Scripting (XSS) - Generic
    13 votes
15. Application error messageInformation Disclosure
    $10012 votes
16. Blacklist bypass on Callback URLsInformation Disclosure
    $10012 votes
17. Email leak in transcations in Android appViolation of Secure Design Principles
    $50011 votes
18. Session Issue Maybe Can lead to huge loss [CRITICAL]Cryptographic Issues - Generic
    $1,00010 votes
19. Race condition allowing user to review app multiple timesBusiness Logic Errors
    8 votes
20. Transactions visible on Unconfirmed devicesImproper Authentication - Generic
    $5008 votes
21. Information disclosure same issue #176002Information Disclosure · low
    $1007 votes
22. Information leakage on https://docs.gdax.comInformation Disclosure
    $1007 votes
23. ByPassing the email Validation Email on Sign up process in mobile appsViolation of Secure Design Principles
    $1007 votes
24. Leaking CSRF token over HTTP resulting in CSRF protection bypassCross-Site Request Forgery (CSRF)
    $1,0007 votes
25. Information disclosure of user by email using buy widgetInformation Disclosure · medium
    6 votes
26. User email enumuration using GmailInformation Disclosure
    6 votes
27. window.opener is leaking to external domains upon redirect on SafariViolation of Secure Design Principles
    5 votes
28. OAUTH pemission set as true= lead to authorize malicious applicationImproper Authentication - Generic
    $1005 votes
29. New Device confirmation tokens are not properly validated.Improper Authentication - Generic
    $1005 votes
30. open authentication bugImproper Authentication - Generic
    4 votes
31. Sending payments via QR code does not require confirmationImproper Authentication - Generic
    $1,0003 votes
32. Sandboxed iframes don't show confirmation screenUI Redressing (Clickjacking)
    3 votes
33. New Device Confirmation, token is valid until not used. Cryptographic Issues - Generic
    3 votes
34. Invoice Details activate JS that filled in Cross-site Scripting (XSS) - Generic
    3 votes
35. CSRF on "Set as primary" option on the accounts pageCross-Site Request Forgery (CSRF)
    $1003 votes
36. Multiple Issues related to registering applicationsViolation of Secure Design Principles
    $1,0003 votes
37. Window.opener bug at www.coinbase.com
    $1002 votes
38. User's legal name could be changed despite front end controls being disabledViolation of Secure Design Principles
    2 votes
39. Direct URL access to completed reportsImproper Authentication - Generic
    $2002 votes
40. Credit Card Validation Issue
    2 votes
41. 2 factor authentication design flawViolation of Secure Design Principles
    2 votes
42. Misconfiguration in 2 factor allows sensitive data exposeInformation Disclosure
    $5001 votes
43. SPF records not foundViolation of Secure Design Principles
    1 votes
44. Big Bug with Vault which i have already reported: Case #606962
    1 votes
45. CSRF in function "Set as primary" on accounts pageCross-Site Request Forgery (CSRF)
    1 votes