Browse / Khan Academy

Khan Academy

See its reports on the map

Attack surface: 382 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Khan Academy

• Cross-site Scripting18
• Misconfiguration9
• Access Control8
• Information Disclosure8
• Cross-Site Request Forgery6
• Authentication4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Take over of accounts created using Google or FacebookCross-Site Request Forgery (CSRF) · critical
   184 votes
2. 1-Click Account Takeover via Open Redirect through Regex Bypass in Domain ValidationImproper Access Control - Generic · critical
   126 votes
3. Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeoversCross-Site Request Forgery (CSRF) · high
   111 votes
4. Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover )Cleartext Storage of Sensitive Information · critical
   107 votes
5. Leaked reused password for a few Khan Academy usersCleartext Storage of Sensitive Information · high
   92 votes
6. 337k users and 1 employee leaked credentialsInformation Disclosure · high
   87 votes
7. XSS on using the legacy "Graphie To Png" APICross-site Scripting (XSS) - DOM · critical
   86 votes
8. Text Injection/ Content Spoofing on https://cloud.e.khanacademy.org by breaking out of input tag.Violation of Secure Design Principles · low
   83 votes
9. Account takeover by changing emailCross-Site Request Forgery (CSRF) · critical
   80 votes
10. Enumerate all the class codes via google dorking Improper Access Control - Generic · high
    44 votes
11. Email Verification Bypass Allows Users to Add & verify Any Email As Guardians Email Privilege Escalation · high
    42 votes
12. S3 bucket takeover [learn2.khanacademy.org]high
    35 votes
13. xss due to incorrect handling of postmessagesCross-site Scripting (XSS) - DOM · critical
    35 votes
14. Login page vulnerable to bruteforce attacks via rate limiting bypassImproper Restriction of Authentication Attempts · low
    34 votes
15. Client-Side Denial of Service (DoS) via Memory Exhaustion on Password Reset EndpointUncontrolled Resource Consumption · high
    32 votes
16. Subdomain takeover on healthyhackathon.khanacademy.org and hackweek.khanacademy.orgImproper Access Control - Generic · high
    30 votes
17. Access to alerta.khanacademy.org leak sensitive data Improper Access Control - Generic · critical
    29 votes
18. Creating Unlimited Fake Accounts.InformativeBusiness Logic Errors · medium
    26 votes
19. Client Side string length checkClient-Side Enforcement of Server-Side Security · medium
    25 votes
20. Information can be changed without a passwordUnverified Password Change · high
    24 votes
21. EMAIL SPOOFINGPrivilege Escalation · medium
    22 votes
22. [critical] sql injection by GET methodSQL Injection · high
    22 votes
23. Sensitive information/action is stored/done is done using a GET requestCross-Site Request Forgery (CSRF)
    20 votes
24. Enumerate class codes via yahoo dork - Can access any course under teacher - Sensitive information leakedInformation Disclosure · high
    18 votes
25. OPEN URL REDIRECT through PNG filesCross-site Scripting (XSS) - Generic · medium
    18 votes
26. The endpoint /api/internal/graphql/requestAuthEmail on Khanacademy.or is vulnerable to Race Condition Attack.Business Logic Errors · medium
    17 votes
27. POST XSS in https://www.khanacademy.org.tr/ via page_search_query parameterCross-site Scripting (XSS) - Generic · medium
    16 votes
28. Bypass the fix of report #1078283 due to poor validationOpen Redirect · high
    14 votes
29. CSV Injection Via Student Password/Name Leads To Client Side RCE And Reading Client FilesCode Injection · medium
    12 votes
30. https://mathfacts.khanacademy.org/ includes code from unprivileged localhost portCode Injection · medium
    12 votes
31. Password authentication when changing information bypass. Bypass of report #721341Unverified Password Change · high
    11 votes
32. Users can make accounts with a fake email address.Informativelow
    11 votes
33. Weak Ciphers EnabledInformation Disclosure
    10 votes
34. Unauthorised Account Detail Modification Improper Access Control - Generic · high
    9 votes
35. Cross site scripting (content-sniffing)Cross-site Scripting (XSS) - Generic · medium
    9 votes
36. Possible Take Over Subdomain For Inbound Emails medium
    9 votes
37. Possible Subdomain TakeoverMisconfiguration · medium
    9 votes
38. CSRF token fixation and potential account takeoverViolation of Secure Design Principles · medium
    9 votes
39. XSS through document projectsCross-site Scripting (XSS) - Stored · high
    9 votes
40. Stored 'undefined' Cross-site ScriptingInformativeCross-site Scripting (XSS) - Stored · medium
    8 votes
41. Khan Academy ClickJacking to Steal Users's CredintialsUI Redressing (Clickjacking)
    7 votes
42. SignUp With Fake EmailInformativeBusiness Logic Errors · medium
    7 votes
43. XSS at http://smarthistory.khanacademy.orgCross-site Scripting (XSS) - Generic
    7 votes
44. Possible to join any class without coache's knowledge & Little Information DisclosureBusiness Logic Errors · medium
    6 votes
45. The web app's forgot password page is vulnerable to text injection/content spoofingCommand Injection - Generic
    6 votes
46. RTL override char allowed at khanacademy redirect pageInformativeViolation of Secure Design Principles · low
    5 votes
47. No Security check at changing password and at adding mobile number which leads to account takeover and spamInformativeViolation of Secure Design Principles · medium
    5 votes
48. Html injection on khanacademyCommand Injection - Generic
    5 votes
49. Open Redirection in SmartHistory KhanAcademyOpen Redirect
    5 votes
50. Persistent class XSS [the fuck]Cross-site Scripting (XSS) - Generic
    5 votes
51. Sql injection And XSSCross-site Scripting (XSS) - Generic
    4 votes
52. CSRF - Adding/Removing items to cart - shop.khanacademy.orgInformativeCross-Site Request Forgery (CSRF)
    4 votes
53. Lighttpd version disclosure / directory listingInformation Disclosure
    4 votes
54. Stored XSS {dangerous?} https://www.khanacademy.org/coach/roster/?listId=allStudentsCross-site Scripting (XSS) - Generic
    4 votes
55. Dom based XSS https://www.khanacademy.org/Cross-site Scripting (XSS) - Generic
    4 votes
56. http://smarthistory.khanacademy.org/search-results.html XSSCross-site Scripting (XSS) - Generic
    4 votes
57. Weak Bithdate Validation Implemented on Sign UpInformativeViolation of Secure Design Principles · low
    3 votes
58. SSL/TLS Vulnerability at khanacademy.orgInformativeCryptographic Issues - Generic · high
    3 votes
59. XSS vulnerability in "/coach/roster/" ( create your first class) Cross-site Scripting (XSS) - Generic
    3 votes
60. Unchecking hidden parameter is vulnerable to XSS-attackInformativeCross-site Scripting (XSS) - Generic
    3 votes
61. Suffix of url-path is vulnerable to XSS-attackCross-site Scripting (XSS) - Generic
    3 votes
62. https://www.khanacademy.org/coach/reports/activity XSSCross-site Scripting (XSS) - Generic
    3 votes
63. User guessing/enumeration at sw.khanacademy.orgInformativeInformation Disclosure
    3 votes
64. Full Path Disclosure on [smarthistory.khanacademy.org]Information Disclosure
    3 votes
65. https://www.khanacademy.org/login open-redirectOpen Redirect
    3 votes
66. Rate Limitation Vulnerability (DDos)DuplicateUncontrolled Resource Consumption · high
    2 votes
67. CRLF InjectionInformativeCross-Site Request Forgery (CSRF)
    2 votes
68. Possible clickjacking at shop.khanacademy.orgInformativeUI Redressing (Clickjacking)
    2 votes
69. Frameset(Frame) html tag is allowed in html editor.(can lead to clickjacking)UI Redressing (Clickjacking) · low
    1 votes
70. Password Functionality not working correctlyInformativeImproper Authentication - Generic · low
    1 votes
71. Escaping the iframe via exceptionsCross-site Scripting (XSS) - Generic