Bug bounty program

EXNESS

Platform: HackerOne
Bounties: Pays
Assets in scope: 14
Disclosed reports: 14
Subdomains: 307

Most upvoted reports14

Most upvoted reports of EXNESS
Report	Weakness	Disclosed	Bounty	Votes
SSRF in graphQL query (pwapi.ex2b.com)Analysed#1864188	Server-Side Request Forgery	2023-07-24	$3,000	261
Blind SSRF on https://my.exnessaffiliates.com/ allows for internal network enumerationAnalysed#1832494	Server-Side Request Forgery	2023-10-25	–	120
Unrestricted Access to Celery Flower InstanceAnalysed#2264960	No weakness recorded	2023-12-14	–	97
IDOR in Stats API Endpoint Allows Viewing Equity or Net Profit of Any MT AccountAnalysed#1644436	Insecure Direct Object Reference	2022-12-05	–	58
Taking position in a discontinued forex pair without executing any tradesAnalysed#1509211	No weakness recorded	2022-04-13	–	32
[com.exness.android.pa Android] Universal XSS in webview. Lead to steal user cookiesAnalysed#532836	Access Control	2022-05-24	$400	26
Access control vulnerability (read-only)Analysed#1159367	Insecure Direct Object Reference	2022-04-13	–	25
Verification process done using different documents without corresponding to user information / User information can be changed after verificationAnalysed#1446107	Input Validation and Logic	2023-01-27	–	25
Access control vulnerability (read/write)#1174734	Insecure Direct Object Reference	2022-04-13	–	22
Double forward slash breaks server-side restrictions & allows access to prohibited services from a partner account#1829170	No weakness recorded	2023-02-10	–	16

Subdomains307

Root

Scope:In scope

Name suggests:Source code

First seen

Text fileClear filters0 names

No subdomain matches

Remove a filter or pick another root.

Clear filters

1 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.