Skip to content
Sign in

Bug bounty program

LO

Logitech

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
86
Disclosed reports
15
Subdomains
7,102
Vendor on CyberSIXT
Logitech (26 CVEs, 0 exploited)

Most upvoted reports15

All reports
Most upvoted reports of Logitech
ReportWeaknessDisclosedBountyVotes
One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.com#1046630Cross-Site Request Forgery2021-01-06–99
Manipulating response leads to free access to Streamlabs Prime#1070510Input Validation and Logic2021-01-21–80
Stored XSS in [https://streamlabs.com/dashboard#/*goal] pages#1049012Cross-site Scripting2020-12-26–68
IDOR when creating App on [platform.streamlabs.com/api/v1/store/whitelist] with user_id field#983070Insecure Direct Object Reference2020-11-26–61
session takeover via open protocol redirection on streamlabs.com#1178239Open Redirect2021-09-01$20050
CSRF in changing users donation_settings [https://streamlabs.com/api/v6/viewer-portal/viewer-settings/donation_settings]#1049360Cross-Site Request Forgery2020-12-26–49
SSRF allows reading AWS EC2 metadata using "readapi" variable in Streamlabs Cloudbot#1108418Server-Side Request Forgery2021-02-24$20041
Privilege Escalation Leads to Control The Owner Access Token Which leads to control the stream [streamlabs.com]#1174527Access Control2021-04-27–38
Host Header injection in oslo.io (using X-Forwarded-For header) leading to email spoofing#1072277Input Validation and Logic2021-01-07–37
Sensitive information disclosure to shared access user via streamlabs platform api#1072893Information Disclosure2021-01-20$20036

Subdomains7,102

Root:streamlabs.com
Scope
Name suggests:Test and QA
First seen
Text fileClear filters2 names
Subdomains of Logitech
NameScopeFirst seen
test.streamlabs.comtestIn scope2026-11-14
io-test.streamlabs.comtestIn scope2026-11-14

1,405 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in