Keybase Program Statistics

View program

32 total issues disclosed

$40,350 total paid publicly

Most disclosed (5 disclosures) — Violation of Secure Design Principles

Disclosed Reports

Report Title Vulnerability Type Disclosed By Severity Disclosed on
Keybase client (Windows 10): Write files anywhere in userland using relative path in "download attachement" feature Remote File Inclusion op1um High 2020-06-26
macOS privilege escalation Privilege Escalation u3mur4 Medium 2020-01-25
From nobody to somebody Privilege Escalation u3mur4 Medium 2020-01-25
SOP bypass using browser cache Improper Access Control - Generic aaron_costello Low 2019-12-24
SOP bypass using browser cache Improper Access Control - Generic aaron_costello Low 2019-12-24
XSS on Desktop Client Cross-site Scripting (XSS) - DOM u3mur4 Medium 2019-10-16
Keybase client: downloaded executables lack "com.apple.quarantine" meta-attribute [macOS] None supplied metnew Medium 2019-09-16
Keybase client: downloaded executables lack "com.apple.quarantine" meta-attribute [macOS] None supplied metnew Medium 2019-09-16
Persistent XSS on keybase.io via "payload" field in `/user/sigchain_signature.toffee` template Cross-site Scripting (XSS) - Stored jordanmilne High 2019-03-14
Linux privilege escalation via trusted $PATH in keybase-redirector Privilege Escalation mirchr High 2018-12-18
Privilege Escalation via Keybase Helper Privilege Escalation xpn High 2018-12-18
Fix bypass of different processing of usernames on Hackernews Business Logic Errors mishre Low 2018-04-08
Difference in query string parameter processing between Hacker News and Keybase Chrome extension spawns chat to incorrect user Violation of Secure Design Principles tomnomnom Low 2018-03-02
Keybase extension hostname-validation regular expression issue. Business Logic Errors edoverflow No rating 2018-01-26
Claiming ownership of GitHub handles via forked GitHub gists. Business Logic Errors edoverflow Low 2018-01-23
Universal Cross-Site Scripting in Keybase Chrome extension Cross-site Scripting (XSS) - DOM jupenur Medium 2017-07-26
Denial of Service through set_preference.json Denial of Service cablej No rating 2016-10-07
[keybase.io] Open Redirect Open Redirect bobrov No rating 2016-09-26
Race conditions can be used to bypass invitation limit None supplied franjkovic No rating 2016-08-10
Un-handled exception leads to Information Disclosure Information Disclosure sarwarjahan No rating 2016-07-15
Register multiple users using one invitation (race condition) None supplied franjkovic No rating 2016-07-11
Remote Server Restart Lead to Denial of Service by only one Request. Denial of Service ahmed_abdalla No rating 2016-06-18
Content spoofing due to the improper behavior of the not-found meesage Violation of Secure Design Principles saeedhashem No rating 2016-02-08
Remote Server Restart Lead to Denial of Server by only one Request. Denial of Service ahmed_abdalla No rating 2016-02-06
xss Cross-site Scripting (XSS) - Generic geeknik No rating 2015-10-30
Sensitive server-side/application information disclosure Information Disclosure sarwar_jahan_m No rating 2015-10-30
Full path disclosure at https://keybase.io/_/api/1.0/invitation_request.json Information Disclosure s_p_q_r No rating 2015-09-04
SMTP protection not used Violation of Secure Design Principles test-123 No rating 2015-08-28
NO SPF RECORDS Violation of Secure Design Principles mafia No rating 2015-08-28
Content Sniffing not disabled Cryptographic Issues - Generic lalakhan No rating 2015-08-05
No rate limiting for sensitive actions (like "forgot password") enables user enumeration Violation of Secure Design Principles paresh_parmar No rating 2015-08-04
Stealing CSRF Tokens Cross-Site Request Forgery (CSRF) akhil-reni No rating 2015-07-22