Browse / Reddit

Reddit

See its reports on the map

Attack surface: 23,159 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Reddit

• Access Control14
• Authentication13
• Cross-site Scripting10
• Insecure Direct Object Reference6
• Business Logic5
• Information Disclosure4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. IDOR lets a malicious user reveal the unpinned achievement badges of any Reddit userInformativeInsecure Direct Object Reference (IDOR) · low
   47 votes
2. Can use the Reddit android app as usual even though revoking the access of it from reddit.comInformativeInsufficient Session Expiration · critical
   20 votes
3. Misconfigurated login page able to lock login action for any account without user interactionInformativeImproper Authentication - Generic · critical
   19 votes
4. api keys leakedInformativeImproper Access Control - Generic · medium
   16 votes
5. oauth misconfigration lead to account takeoverInformativeIncorrect Authorization
   11 votes
6. HTML injection in API response including request urlInformativeRemote File Inclusion · critical
   11 votes
7. Application level DOS at Login Page ( Accepts Long Password )InformativeImproper Authentication - Generic · high
   11 votes
8. registering with the same email address multiple times leads to account takeover InformativeImproper Authentication - Generic · low
   11 votes
9. Open Redirect through POST Request in www.redditinc.comInformativeOpen Redirect · medium
   10 votes
10. hardcoded api secret & api key in com.reddit.frontpageInformativeImproper Authentication - Generic · critical
    8 votes
11. Regular Expression Denial of Service vulnerabilityInformativeUncontrolled Resource Consumption · medium
    6 votes
12. Broken links make users from France unable to understand the allowed content policyInformative
    6 votes
13. S3 bucket Upload on studio.redditinc.com (s3-r-w.ap-east-1.amazonaws.com)InformativeImproper Access Control - Generic · low
    4 votes