Skip to content
Connect AISign inSign up free

Bug bounty program

8X

8x8

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
117
Disclosed reports
91
Subdomains
9,482

Most upvoted reports91

All reports
Most upvoted reports of 8x8
ReportWeaknessDisclosedBountyVotes
connect.8x8.com/api/v1: JWT Algorithm Confusion VulnerabilityAnalysed#3800870Cryptography2026-07-22$1,337111
Stored xss at https://█.8x8.com/api/█/IDAnalysed#2078490Cross-site Scripting2023-10-30$1,337108
connect.8x8.com: admin user can send invites on behalf of another admin user via POST /api/v1/users/<User ID>/invitesAnalysed#1474536Access Control2023-02-15–105
Information Disclosure of metrics fax.wavecell.com/metricsAnalysed#1365076Information Disclosure2025-05-30–93
█.8x8.vc/index.js: Exposed Google Maps API Key Allowing Potential Abuse of Paid ServicesAnalysed#3250315Information Disclosure2025-08-14$50088
jitsi-meet: Prosody/Jigasi missing header whitelist in mod_filter_iq_rayo allows arbitrary SIP header injection and Caller ID spoofingAnalysed#3789570Input Validation and Logic2026-07-02$10072
jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`Analysed#3485343File and Path Handling2026-07-02$10068
connect.8x8.com: Blind SSRF via /api/v2/chats/image-check allows for Internal Ports scanAnalysed#1875484Server-Side Request Forgery2023-05-15–65
JaaS SIP Gateway Authorization BypassAnalysed#3837634Access Control2026-08-12$50064
Jitsi Desktop Client RCE By Interacting with Malicious URL Schemes on WindowsAnalysed#1692603Command and Code Injection2023-02-10$77751

Subdomains9,482

Root
Scope
Name suggests:Source code
First seen
Text fileClear filters11 names
Subdomains of 8x8
NameScopeFirst seen
git.8x8.comgitIn scope2026-11-14
git.es.8x8.comgitIn scope2026-11-14
git.www.8x8.comgitIn scope2026-11-14
gitlab.h.8x8.comgitIn scope2026-11-14
gitlab.www.8x8.comgitIn scope2026-11-14
octo7-repo.cloud-mgmt.8x8cloud.netgitIn scope2026-11-14
git.dxi.eugitNot in the scope2026-11-14
svn.dxi.eugitNot in the scope2026-11-14
git.jitsi.orggitListed out of scope2026-11-14
gitlab.corp.sameroom.iogit, internalListed out of scope2026-11-14
santander-scm-uat.ro.ucverse.comgit, testIn scope2026-11-14

7,296 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated