Bug bounty program
IN
InnoGames
- Platform
- Intigriti
- Bounties
- Pays
- Assets in scope
- 5
- Disclosed reports
- 8
Most upvoted reports8
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Blind SQL Injection#758654 | SQL Injection | – | $2,000 | 432 |
| Chaining Bugs: Leakage of CSRF token which leads to Stored XSS and Account Takeover (xs1.tribalwars.cash)#604120 | Information Disclosure | – | $1,100 | 186 |
| Race condition in activating email resulting in infinite amount of diamonds received#509629 | Race Conditions | – | $2,000 | 137 |
| Create any military unit in any age#802636 | Input Validation and Logic | – | $1,100 | 89 |
| Cache Poisoning via uppercase letters in invalid path#960618 | Misconfiguration and Insecure Design | – | $550 | 82 |
| Unprivileged alliance member is able to recruit new members to his alliance and accepting them (xs1.grepolis.com)#511275 | Access Control | – | $550 | 70 |
| Impersonation and ticket id enumeration on support.innogames.com#876573 | Access Control | – | $550 | 8 |
| Stored XSS on recruit.innogames.de#917250 | Cross-site Scripting | – | $500 | 7 |
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.