Browse / Reddit

Reddit

See its reports on the map

Attack surface: 23,159 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Reddit

• Access Control14
• Authentication13
• Cross-site Scripting10
• Insecure Direct Object Reference6
• Business Logic5
• Information Disclosure4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comImproper Access Control - Generic · critical
   509 votes
2. [accounts.reddit.com] Redirect parameter allows for XSSCross-site Scripting (XSS) - Generic · high
   $5,000394 votes
3. Blind SSRF to internal services in matrix preview_link APIServer-Side Request Forgery (SSRF) · high
   $6,000344 votes
4. Exposed proxy allows to access internal reddit domainsImproper Access Control - Generic · high
   $7,500296 votes
5. RichText parser vulnerability in scheduled posts allows XSSCross-site Scripting (XSS) - Stored · high
   $5,000280 votes
6. Deleting all DMs on RedditGifts.comInsecure Direct Object Reference (IDOR) · high
   $5,000267 votes
7. XSS via Mod Log Removed PostsCross-site Scripting (XSS) - Stored · high
   218 votes
8. IDOR allows an attacker to modify the links of any userInsecure Direct Object Reference (IDOR) · high
   208 votes
9. Able to bypass email verification and change email to any other user email Improper Access Control - Generic · high
   $5,000200 votes
10. Able to approve admin approval and change effective status without adding payment details . Business Logic Errors · high
    $5,000191 votes
11. Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.Improper Access Control - Generic · high
    186 votes
12. Reflected xss in https://sh.reddit.comCross-site Scripting (XSS) - Reflected · high
    $5,000166 votes
13. Getting access of mod logs from any public or restricted subreddit with IDOR vulnerabilityInsecure Direct Object Reference (IDOR) · high
    $5,000163 votes
14. XSS Reflected on reddit.com via url pathCross-site Scripting (XSS) - Reflected · high
    157 votes
15. Regression on dest parameter sanitization doesn't check scheme/websafe destinationsCross-site Scripting (XSS) - Reflected · medium
    $500101 votes
16. s3 bucket takeover presented in https://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/full-build-macos.shBusiness Logic Errors · high
    96 votes
17. Reddit talk promotion offers don't expire, allowing users to accept them after being demotedInsecure Direct Object Reference (IDOR) · medium
    72 votes
18. GPS metadata preserved when converting HEIF to PNGPrivacy Violation · high
    67 votes
19. Image queue default key of 'None' and GraphQL unhandled type exceptionType Confusion · medium
    $50065 votes
20. Outsider can affect Upvote Percentage of private subreddit post by calling /api/vote APIImproper Access Control - Generic · low
    52 votes
21. CSRF (protection bypassed) to force a below 18 user into viewing an nsfw subreddit !Cross-Site Request Forgery (CSRF) · medium
    47 votes
22. Hash-Collision Denial-of-Service Vulnerability in Markdown ParserUncontrolled Resource Consumption · medium
    44 votes
23. IDOR to pay less for coin purchases on oauth.reddit.com via /api/v2/gold/paypal/create_coin_purchase_order in `order_id` parameter Business Logic Errors · medium
    $50042 votes
24. Race condition leads to Inflation of coins when bought via Google Play Store at endpoint https://oauth.reddit.com/api/v2/gold/android/verify_purchase Time-of-check Time-of-use (TOCTOU) Race Condition · medium
    42 votes
25. Open Redirect on www.redditinc.com via `failed` query paramOpen Redirect · medium
    41 votes
26. Weak rate limit could lead to ATO due to weak password protection mechanismsImproper Restriction of Authentication Attempts · low
    39 votes
27. Unrestricted File Upload on reddit.secure.force.comImproper Access Control - Generic · low
    $10034 votes
28. [dubsmash] Long String in 'shoutout' Parameter Leading Internal server Error on Popular hastags , Community and User ProfileUncontrolled Resource Consumption · high
    33 votes
29. Third party app could steal access token as well as protected files using inAppBrowserInformation Disclosure · medium
    32 votes
30. No Rate Limit on redditgifts gift when Adding CommentViolation of Secure Design Principles · low
    25 votes
31. Open Redirect on www.redditinc.com via `failed` query param bypass after fixed bug #1257753Open Redirect · medium
    21 votes
32. [dubmash] Lack of authorization checks - Update Sound TitlesImproper Authorization · high
    21 votes
33. Domain Takeover of Reddit.ru via DNS HijackingImproper Access Control - Generic · medium
    $50020 votes
34. Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations`Improper Input Validation · low
    $10019 votes
35. [dubsmash] Username and password bruteforceImproper Restriction of Authentication Attempts · low
    18 votes