Browse / Stripe

Stripe

See its reports on the map

Attack surface: 1,492 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Stripe

• Access Control6
• Authentication3
• Insecure Direct Object Reference3
• Cross-Site Request Forgery3
• Misconfiguration3
• Business Logic2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Fee discounts can be redeemed many times, resulting in unlimited fee-free transactionsBusiness Logic Errors · medium
   $5,000266 votes
2. Mass Account Takeover at https://app.taxjar.com/ - No user InteractionAuthentication Bypass Using an Alternate Path or Channel · critical
   253 votes
3. Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/ Authentication Bypass Using an Alternate Path or Channel · high
   212 votes
4. Email change or personal data change on the account.Insecure Direct Object Reference (IDOR) · critical
   $3,000149 votes
5. Possible XSS vulnerability without a content security bypassCross-site Scripting (XSS) - Generic · medium
   $2,000131 votes
6. CSRF token validation system is disabled on Stripe DashboardCross-Site Request Forgery (CSRF) · medium
   113 votes
7. Mass account takeover!Misconfiguration · high
   101 votes
8. User can pay using archived price by manipulating the request sent to `POST /v1/payment_pages/for_plink`Insecure Direct Object Reference (IDOR) · medium
   100 votes
9. CSRF token validation system is disabled on Stripe DashboardCross-Site Request Forgery (CSRF) · medium
   $2,50087 votes
10. Promotion code can be used more than redemption limit.Time-of-check Time-of-use (TOCTOU) Race Condition · low
    55 votes
11. HTML Injection in the Invoice memos fieldImproper Access Control - Generic · medium
    $50053 votes
12. Bypassing domain deny_list rule in Smokescreen via trailing dot leads to SSRFServer-Side Request Forgery (SSRF) · low
    51 votes
13. XSS vulnerability without a content security bypass in a `CUSTOM` App through Button tagCross-site Scripting (XSS) - Generic · medium
    $2,00046 votes
14. Tomcat Servlet Examples accessible at https://44.240.33.83:38443 and https://52.36.56.155:38443Improper Authorization · medium
    39 votes
15. Verifying email bypassImproper Access Control - Generic · low
    35 votes
16. Fully TaxJar account control and ability to disclose and modify business account settings Due to Broken Access Control in /current_user_dataImproper Access Control - Generic · medium
    33 votes
17. The `stripe/veneur` GitHub repository links to a domain `veneur.org`, which is not under stripe's controlMisconfiguration · low
    26 votes
18. [Broken Access Control ] Unauthorized Linking accounts & Linked Accounts info DIsclosureImproper Access Control - Generic · low
    26 votes
19. CSRF in Importing CSV files [app.taxjar.com]Cross-Site Request Forgery (CSRF) · low
    26 votes
20. GRAPHQL cross-tenant IDOR giving write access thought the operation UpdateAtlasApplicationPersonInsecure Direct Object Reference (IDOR) · high
    25 votes
21. Unauthorized Canceling/Unsubscribe TaxJar account & Payment information DIsclosureImproper Access Control - Generic · medium
    24 votes
22. Bypass global deny-lists by wrapping domains using "[]" in https://github.com/stripe/smokescreenImproper Input Validation · low
    20 votes
23. Local applications from user's computer can listen for webhooks via insecure gRPC server from stripe-cliImproper Authentication - Generic · low
    20 votes
24. Without verifying email and activate account, user can perform all action which are not supposed to be doneViolation of Secure Design Principles · low
    20 votes
25. Object injection in `stripe-billing-typographic` GitHub project via /auth/login Resource Injection · low
    17 votes
26. Bypassing domain deny_list rule in Smokescreen via double brackets [[]] which leads to SSRFServer-Side Request Forgery (SSRF) · low
    11 votes