Browse / Khan Academy

Khan Academy

See its reports on the map

Attack surface: 382 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Khan Academy

• Cross-site Scripting18
• Misconfiguration9
• Access Control8
• Information Disclosure8
• Cross-Site Request Forgery6
• Authentication4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Creating Unlimited Fake Accounts.InformativeBusiness Logic Errors · medium
   26 votes
2. Users can make accounts with a fake email address.Informativelow
   11 votes
3. Stored 'undefined' Cross-site ScriptingInformativeCross-site Scripting (XSS) - Stored · medium
   8 votes
4. SignUp With Fake EmailInformativeBusiness Logic Errors · medium
   7 votes
5. RTL override char allowed at khanacademy redirect pageInformativeViolation of Secure Design Principles · low
   5 votes
6. No Security check at changing password and at adding mobile number which leads to account takeover and spamInformativeViolation of Secure Design Principles · medium
   5 votes
7. CSRF - Adding/Removing items to cart - shop.khanacademy.orgInformativeCross-Site Request Forgery (CSRF)
   4 votes
8. Weak Bithdate Validation Implemented on Sign UpInformativeViolation of Secure Design Principles · low
   3 votes
9. SSL/TLS Vulnerability at khanacademy.orgInformativeCryptographic Issues - Generic · high
   3 votes
10. Unchecking hidden parameter is vulnerable to XSS-attackInformativeCross-site Scripting (XSS) - Generic
    3 votes
11. User guessing/enumeration at sw.khanacademy.orgInformativeInformation Disclosure
    3 votes
12. CRLF InjectionInformativeCross-Site Request Forgery (CSRF)
    2 votes
13. Possible clickjacking at shop.khanacademy.orgInformativeUI Redressing (Clickjacking)
    2 votes
14. Password Functionality not working correctlyInformativeImproper Authentication - Generic · low
    1 votes