Browse / Logitech

Logitech

See its reports on the map

Attack surface: 7,102 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Logitech

• Open Redirect3
• Cross-Site Request Forgery2
• Business Logic2
• Cross-site Scripting2
• Access Control2
• Insecure Direct Object Reference1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.comCross-Site Request Forgery (CSRF) · medium
   99 votes
2. Manipulating response leads to free access to Streamlabs Prime Business Logic Errors · medium
   80 votes
3. Stored XSS in [https://streamlabs.com/dashboard#/*goal] pagesCross-site Scripting (XSS) - Stored · low
   68 votes
4. IDOR when creating App on [platform.streamlabs.com/api/v1/store/whitelist] with user_id fieldInsecure Direct Object Reference (IDOR) · low
   61 votes
5. session takeover via open protocol redirection on streamlabs.comOpen Redirect · medium
   $20050 votes
6. CSRF in changing users donation_settings [https://streamlabs.com/api/v6/viewer-portal/viewer-settings/donation_settings]Cross-Site Request Forgery (CSRF) · medium
   49 votes
7. SSRF allows reading AWS EC2 metadata using "readapi" variable in Streamlabs CloudbotServer-Side Request Forgery (SSRF) · medium
   $20041 votes
8. Privilege Escalation Leads to Control The Owner Access Token Which leads to control the stream [streamlabs.com]Privilege Escalation · low
   38 votes
9. Host Header injection in oslo.io (using X-Forwarded-For header) leading to email spoofingBusiness Logic Errors · high
   37 votes
10. Sensitive information disclosure to shared access user via streamlabs platform apiInformation Disclosure · medium
    $20036 votes
11. GET based Open redirect on [streamlabs.com/content-hub/streamlabs-obs/search?query=]Open Redirect · low
    $10034 votes
12. Steal any users `access_token` via open redirect in https://streamlabs.com/global/identity?popup=1&r=Open Redirect · medium
    27 votes
13. Stored XSS on oslo.io in notifications via project name changeCross-site Scripting (XSS) - Stored · medium
    26 votes
14. Moderator user has access to owner's support portal and ticketsImproper Access Control - Generic · medium
    $20019 votes
15. clickjacking on deleting user's clips [https://crossclip.com/clips]UI Redressing (Clickjacking) · low
    4 votes