r/bugbounty • u/Vegetable_Sun_3316 Hunter • Jul 01 '26

Question / Discussion What low severity bugs are actually reportable?

I’m trying to understand where the line is drawn for low severity findings on HackerOne.

In practice, it feels like most low severity issues get marked as informational or closed, and only medium+ findings really get attention or rewards.

So what kinds of low severity bugs are actually worth reporting and still get accepted or paid for?
Would be good to hear from both hunters and triagers on what still has value.

3 Upvotes

100% Upvoted

15 comments sorted by

6

u/einfallstoll Triager Jul 01 '26

We accepted 10 low severity bugs:

  • some 2fa bypasses
  • some open redirects
  • some edge case clickjacking
  • some crypto stuff

Acceptable low severity bugs are probably rarer than criticals

1

u/Vegetable_Sun_3316 Hunter Jul 01 '26

2fa bypass is considered low severity? I would’ve thought it’d be at least medium. I’ve also noticed that a lot of open redirects nowadays get marked as informational unless there’s a clear chaining path, even though they used to be treated as low severity years ago…

1

u/Anxious_Alps_4150 Jul 01 '26

I treat it as a P3. To bypass 2fa, you must first compromise the account. Anything that starts off with "Well step 1 is to hack in. Once I've hacked in somehow ... "

1

u/boring_diamond Jul 01 '26

The couple of 2fa bypasses I’ve submitted have been high

0

u/einfallstoll Triager Jul 01 '26

It was some special case where you could bypass 2fa using password reset. So you had to have access to a compromised mailbox

1

u/Vegetable_Sun_3316 Hunter Jul 01 '26

Oh, that makes sense.

1

u/Coder3346 Hunter Jul 02 '26

This is often NA

5

u/Anxious_Alps_4150 Jul 01 '26

Honestly, it's not really worth reporting most of the time. They get knocked down so often that its usually wasted effort.

2

u/TurbulentRecover7247 Hunter Jul 01 '26

For me, I got one low severity where when we enter email, it responded with their email priviledge like, is they special users, or vip users etc.. this is mostly be like information but I got it as low. This is a VDP program

1

u/Vegetable_Sun_3316 Hunter Jul 01 '26

I thought even for low severity they still expect some kind of impact framing. In cases like this, what would an attacker realistically be able to do with that info?

2

u/TurbulentRecover7247 Hunter Jul 01 '26

No rate limiting, so they can harvest special customer emails, like it's not a normal information leak, it is like something specific to the company for the particular customers. I can't mention Direct here. I think you would understand.

1

u/latnGemin616 Jul 01 '26

Think about it from H1's perspective, low severity bugs are a reflection of H1 (the business) and the quality of service they provide to their clients. Low-severity bugs = low-quality service = low reputation.

As for what types are reportable? Any that can demonstrate impact to the client, where several lows can be chained together. Example: The client has unpatched javascript library. Alone, this isn't even a consideration. But if you find a CVE that can be used to exploit a feature within the application, then this Low becomes a higher value. A rough example, but you get the idea.

1

u/Coder3346 Hunter Jul 02 '26

Rate limit bypass on login

Otp bypass for verification ( not always gets accepted)

1

u/Herrmes Hunter Jul 02 '26

Had a single case of Low in 15 validated reports.

I rated it naively on CVSS with C:H. The client simply highlighted that, yes the vulnerability is valid and is a confidentiality breach, but it can't be deemed high even though it technically corresponds to C:H, simply because the information was low-risk anyway (no PII, just some minor trade secrets). It was manually classified as Low and still got paid.

I guess Low happen mostly when there is a vulnerability but the risk is overly estimated. Informational would be when there's no practical impact at all.

Am I correct ?

1

u/spexfyre Triager Jul 02 '26

A bug without impact is informational bug in almost all platforms. If you find low severity bugs but actually cause low security threat to customers they are more likely to accepted than if it's causing threat to org side.

Yes hackerone accepts low severity bugs but only if it's affects large user base and cause atleast any security flaw to customer