Skip to content
Connect AISign inSign up free

Bug bounty program

BI

Bitwarden

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
21
Disclosed reports
11
Subdomains
77
Vendor on CyberSIXT
Bitwarden (17 CVEs, 0 exploited)

Most upvoted reports11

All reports
Most upvoted reports of Bitwarden
ReportWeaknessDisclosedBountyVotes
Bypass for forced re-authentication upon biometrics changeAnalysed#1929915Authentication2023-07-19–37
Organization Admin Privilege Escalation To OwnerAnalysed#272570Input Validation and Logic2017-10-28–28
Vulnerable exported broadcast receiverAnalysed#289000Misconfiguration and Insecure Design2017-11-10–24
Blind HTTP GET SSRF via website icon fetch (bypass of pull#812)Analysed#925527Server-Side Request Forgery2020-09-11–21
Biometric key is stored in Windows Credential Manager, accessible to other local unprivileged processesAnalysed#1874155Cryptography2023-06-07–19
Mailgun misconfiguration on email.bitwarden.comAnalysed#272357Input Validation and Logic2017-10-27–17
Server-Side Request Forgery in "icons.bitwarden.net"#913276Server-Side Request Forgery2020-08-07–13
Rate limits too low for email 2FA#979820Authentication2020-10-14–11
When uploading attachments, unencrypted file names are made available to the server#1206799Cryptography2021-08-02–8
Tracking Bitwarden firefox addon users#337189No weakness recorded2018-05-23–7

Subdomains77

Root
Scope
Name suggests
First seen
Text file77 names
Subdomains of Bitwarden
NameScopeFirst seen
bid47bv.22371289m.bitwarden.comNot in the scope2026-11-14
admin.bitwarden.comadminNot in the scope2026-11-14
adr.bitwarden.comNot in the scope2026-11-14
api.bitwarden.comapiIn scope2026-11-14
artifacts.bitwarden.comNot in the scope2026-11-14
assets.bitwarden.comNot in the scope2026-11-14
bassets.bitwarden.comNot in the scope2026-11-14
billing.bitwarden.comNot in the scope2026-11-14
blog.bitwarden.comNot in the scope2026-11-14
www.blog.bitwarden.comNot in the scope2026-11-14
btwh.bitwarden.comNot in the scope2026-11-14
bws.bitwarden.comNot in the scope2026-11-14
cdn.bitwarden.comNot in the scope2026-11-14
checkout.bitwarden.comNot in the scope2026-11-14
community.bitwarden.comNot in the scope2026-11-14
company.bitwarden.comNot in the scope2026-11-14
components.bitwarden.comNot in the scope2026-11-14
contributing.bitwarden.comNot in the scope2026-11-14
contributing-internal.bitwarden.cominternalNot in the scope2026-11-14
dd.bitwarden.comNot in the scope2026-11-14
demo.bitwarden.comtestNot in the scope2026-11-14
diana.bitwarden.comNot in the scope2026-11-14
dl.bitwarden.comNot in the scope2026-11-14
docs.bitwarden.comNot in the scope2026-11-14
events.bitwarden.comNot in the scope2026-11-14
fillassist.bitwarden.comNot in the scope2026-11-14
fmtrack1.bitwarden.comNot in the scope2026-11-14
fmtracks.bitwarden.comNot in the scope2026-11-14
forms.bitwarden.comNot in the scope2026-11-14
func.bitwarden.comNot in the scope2026-11-14
func2.bitwarden.comNot in the scope2026-11-14
geeks.bitwarden.comNot in the scope2026-11-14
get.bitwarden.comNot in the scope2026-11-14
go.bitwarden.comNot in the scope2026-11-14
url4499.go.bitwarden.comNot in the scope2026-11-14
url8843.go.bitwarden.comNot in the scope2026-11-14
help.bitwarden.comIn scope2026-11-14
host.bitwarden.comNot in the scope2026-11-14
icons.bitwarden.comNot in the scope2026-11-14
identity.bitwarden.comauthIn scope2026-11-14
lewebapp.bitwarden.comNot in the scope2026-11-14
link.bitwarden.comNot in the scope2026-11-14
mail.bitwarden.commailNot in the scope2026-11-14
o1.mail1.bitwarden.commailNot in the scope2026-11-14
mobileapp.bitwarden.comNot in the scope2026-11-14
n8n.bitwarden.comNot in the scope2026-11-14
nobileapp.bitwarden.comNot in the scope2026-11-14
notifications.bitwarden.comNot in the scope2026-11-14
onyx.bitwarden.comNot in the scope2026-11-14
pdf-convert.bitwarden.comNot in the scope2026-11-14
portal.bitwarden.comNot in the scope2026-11-14
preview.bitwarden.comstagingNot in the scope2026-11-14
o2.ptr4810.bitwarden.comNot in the scope2026-11-14
o1.ptr996.bitwarden.comNot in the scope2026-11-14
push.bitwarden.comNot in the scope2026-11-14
qa.bitwarden.comtestNot in the scope2026-11-14
cdn.qa.bitwarden.comtestNot in the scope2026-11-14
sales.bitwarden.comNot in the scope2026-11-14
scim.bitwarden.comNot in the scope2026-11-14
sdk-api-docs.bitwarden.comapiNot in the scope2026-11-14
selfhost.bitwarden.comNot in the scope2026-11-14
send.bitwarden.comNot in the scope2026-11-14
shelfhost.bitwarden.comNot in the scope2026-11-14
shj.bitwarden.comNot in the scope2026-11-14
shop.bitwarden.comNot in the scope2026-11-14
simian.bitwarden.comNot in the scope2026-11-14
sso.bitwarden.comauthNot in the scope2026-11-14
start.bitwarden.comNot in the scope2026-11-14
status.bitwarden.commonitoringNot in the scope2026-11-14
support.bitwarden.comNot in the scope2026-11-14
techdiagrams.bitwarden.comNot in the scope2026-11-14
test.bitwarden.comtestNot in the scope2026-11-14
testdo.bitwarden.comNot in the scope2026-11-14
track.bitwarden.comNot in the scope2026-11-14
vault.bitwarden.comtoolsIn scope2026-11-14
web-vault.bitwarden.comtoolsNot in the scope2026-11-14
www.bitwarden.comNot in the scope2026-11-14

4 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated