Browse / Khan Academy

Khan Academy

See its reports on the map

Attack surface: 382 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Khan Academy

• Cross-site Scripting18
• Misconfiguration9
• Access Control8
• Information Disclosure8
• Cross-Site Request Forgery6
• Authentication4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Take over of accounts created using Google or FacebookCross-Site Request Forgery (CSRF) · critical
   184 votes
2. 1-Click Account Takeover via Open Redirect through Regex Bypass in Domain ValidationImproper Access Control - Generic · critical
   126 votes
3. Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeoversCross-Site Request Forgery (CSRF) · high
   111 votes
4. Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover )Cleartext Storage of Sensitive Information · critical
   107 votes
5. Leaked reused password for a few Khan Academy usersCleartext Storage of Sensitive Information · high
   92 votes
6. 337k users and 1 employee leaked credentialsInformation Disclosure · high
   87 votes
7. XSS on using the legacy "Graphie To Png" APICross-site Scripting (XSS) - DOM · critical
   86 votes
8. Text Injection/ Content Spoofing on https://cloud.e.khanacademy.org by breaking out of input tag.Violation of Secure Design Principles · low
   83 votes
9. Account takeover by changing emailCross-Site Request Forgery (CSRF) · critical
   80 votes
10. Enumerate all the class codes via google dorking Improper Access Control - Generic · high
    44 votes
11. Email Verification Bypass Allows Users to Add & verify Any Email As Guardians Email Privilege Escalation · high
    42 votes
12. S3 bucket takeover [learn2.khanacademy.org]high
    35 votes
13. xss due to incorrect handling of postmessagesCross-site Scripting (XSS) - DOM · critical
    35 votes
14. Login page vulnerable to bruteforce attacks via rate limiting bypassImproper Restriction of Authentication Attempts · low
    34 votes
15. Client-Side Denial of Service (DoS) via Memory Exhaustion on Password Reset EndpointUncontrolled Resource Consumption · high
    32 votes
16. Subdomain takeover on healthyhackathon.khanacademy.org and hackweek.khanacademy.orgImproper Access Control - Generic · high
    30 votes
17. Access to alerta.khanacademy.org leak sensitive data Improper Access Control - Generic · critical
    29 votes
18. Client Side string length checkClient-Side Enforcement of Server-Side Security · medium
    25 votes
19. Information can be changed without a passwordUnverified Password Change · high
    24 votes
20. EMAIL SPOOFINGPrivilege Escalation · medium
    22 votes
21. [critical] sql injection by GET methodSQL Injection · high
    22 votes
22. Sensitive information/action is stored/done is done using a GET requestCross-Site Request Forgery (CSRF)
    20 votes
23. Enumerate class codes via yahoo dork - Can access any course under teacher - Sensitive information leakedInformation Disclosure · high
    18 votes
24. OPEN URL REDIRECT through PNG filesCross-site Scripting (XSS) - Generic · medium
    18 votes
25. The endpoint /api/internal/graphql/requestAuthEmail on Khanacademy.or is vulnerable to Race Condition Attack.Business Logic Errors · medium
    17 votes
26. POST XSS in https://www.khanacademy.org.tr/ via page_search_query parameterCross-site Scripting (XSS) - Generic · medium
    16 votes
27. Bypass the fix of report #1078283 due to poor validationOpen Redirect · high
    14 votes
28. CSV Injection Via Student Password/Name Leads To Client Side RCE And Reading Client FilesCode Injection · medium
    12 votes
29. https://mathfacts.khanacademy.org/ includes code from unprivileged localhost portCode Injection · medium
    12 votes
30. Password authentication when changing information bypass. Bypass of report #721341Unverified Password Change · high
    11 votes
31. Weak Ciphers EnabledInformation Disclosure
    10 votes
32. Unauthorised Account Detail Modification Improper Access Control - Generic · high
    9 votes
33. Cross site scripting (content-sniffing)Cross-site Scripting (XSS) - Generic · medium
    9 votes
34. Possible Take Over Subdomain For Inbound Emails medium
    9 votes
35. Possible Subdomain TakeoverMisconfiguration · medium
    9 votes
36. CSRF token fixation and potential account takeoverViolation of Secure Design Principles · medium
    9 votes
37. XSS through document projectsCross-site Scripting (XSS) - Stored · high
    9 votes
38. Khan Academy ClickJacking to Steal Users's CredintialsUI Redressing (Clickjacking)
    7 votes
39. XSS at http://smarthistory.khanacademy.orgCross-site Scripting (XSS) - Generic
    7 votes
40. Possible to join any class without coache's knowledge & Little Information DisclosureBusiness Logic Errors · medium
    6 votes
41. The web app's forgot password page is vulnerable to text injection/content spoofingCommand Injection - Generic
    6 votes
42. Html injection on khanacademyCommand Injection - Generic
    5 votes
43. Open Redirection in SmartHistory KhanAcademyOpen Redirect
    5 votes
44. Persistent class XSS [the fuck]Cross-site Scripting (XSS) - Generic
    5 votes
45. Sql injection And XSSCross-site Scripting (XSS) - Generic
    4 votes
46. Lighttpd version disclosure / directory listingInformation Disclosure
    4 votes
47. Stored XSS {dangerous?} https://www.khanacademy.org/coach/roster/?listId=allStudentsCross-site Scripting (XSS) - Generic
    4 votes
48. Dom based XSS https://www.khanacademy.org/Cross-site Scripting (XSS) - Generic
    4 votes
49. http://smarthistory.khanacademy.org/search-results.html XSSCross-site Scripting (XSS) - Generic
    4 votes
50. XSS vulnerability in "/coach/roster/" ( create your first class) Cross-site Scripting (XSS) - Generic
    3 votes
51. Suffix of url-path is vulnerable to XSS-attackCross-site Scripting (XSS) - Generic
    3 votes
52. https://www.khanacademy.org/coach/reports/activity XSSCross-site Scripting (XSS) - Generic
    3 votes
53. Full Path Disclosure on [smarthistory.khanacademy.org]Information Disclosure
    3 votes
54. https://www.khanacademy.org/login open-redirectOpen Redirect
    3 votes
55. Frameset(Frame) html tag is allowed in html editor.(can lead to clickjacking)UI Redressing (Clickjacking) · low
    1 votes
56. Escaping the iframe via exceptionsCross-site Scripting (XSS) - Generic