Bug Bounty in 2025: Part 3 — Investigating 4 Open Redirect Reports at HackerOne, So You Don’t Have…

In this blog, I personally investigated 4 disclosed and triaged open redirect bug bounty reports to understand what kinds of open redirect bugs receive bounties or are considered bounty-worthy.

💴 🚧 🔨 Here is the friendly link to remove the paywall.

Report ID: 2812583
Bounty: Yes
Fixed & Disclosed: Yes
Severity: Low
Date: November 5, 2024, 7:16am UTC

There was a video attached, too — added this as a screenshot.

The Vulnerability

Tumblr’s logout endpoint accepts a redirect_to parameter that determines where the user is sent after logging out. The issue was that Tumblr did not sufficiently validate this parameter. An attacker could supply a URL pointing to a malicious site, causing unsuspecting users to be redirected there.

The Exploit URL

When URL-decoded, the redirect_to parameter becomes: