Skip to content
Sign in

Bug bounty program

LO

Logitech

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
86
Disclosed reports
15
Subdomains
7,102

Most upvoted reports15

All reports
Most upvoted reports of Logitech
ReportWeaknessDisclosedBountyVotes
One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.com#1046630Cross-Site Request Forgery2021-01-06–99
Manipulating response leads to free access to Streamlabs Prime#1070510Input Validation and Logic2021-01-21–80
Stored XSS in [https://streamlabs.com/dashboard#/*goal] pages#1049012Cross-site Scripting2020-12-26–68
IDOR when creating App on [platform.streamlabs.com/api/v1/store/whitelist] with user_id field#983070Insecure Direct Object Reference2020-11-26–61
session takeover via open protocol redirection on streamlabs.com#1178239Open Redirect2021-09-01$20050
CSRF in changing users donation_settings [https://streamlabs.com/api/v6/viewer-portal/viewer-settings/donation_settings]#1049360Cross-Site Request Forgery2020-12-26–49
SSRF allows reading AWS EC2 metadata using "readapi" variable in Streamlabs Cloudbot#1108418Server-Side Request Forgery2021-02-24$20041
Privilege Escalation Leads to Control The Owner Access Token Which leads to control the stream [streamlabs.com]#1174527Access Control2021-04-27–38
Host Header injection in oslo.io (using X-Forwarded-For header) leading to email spoofing#1072277Input Validation and Logic2021-01-07–37
Sensitive information disclosure to shared access user via streamlabs platform api#1072893Information Disclosure2021-01-20$20036

Subdomains7,102

Root
Scope
Name suggests:API
First seen
Text fileClear filters36 names
Subdomains of Logitech
NameScopeFirst seen
api.challonge.comapiNot in the scope2026-11-14
www.api.challonge.comapiNot in the scope2026-11-14
api.jaybirdsport.comapiNot in the scope2026-11-14
www.api.jaybirdsport.comapiNot in the scope2026-11-14
api.video.logi.comapiIn scope2026-11-14
api.circle.logi.comapiIn scope2026-11-14
sqs-api.dev.cto.logi.comapi, devIn scope2026-11-14
sqs-api-staging.dev.cto.logi.comapi, dev, stagingIn scope2026-11-14
sqs-api-production.dev.cto.logi.comapi, devIn scope2026-11-14
sqs-api-experimental.dev.cto.logi.comapi, devIn scope2026-11-14
api.configurator.logitech.comapiIn scope2026-11-14
wss-dev-api.dev.vc.logitech.comapi, devIn scope2026-11-14
wss-dev1-api.dev.vc.logitech.comapi, devIn scope2026-11-14
api-creatorcommunity.logitech.comapiIn scope2026-11-14
api.create-your-space.logitech.comapiIn scope2026-11-14
wss-stable-api.dev.vc.logitech.comapi, devIn scope2026-11-14
wss-sandbox-api.dev.vc.logitech.comapi, dev, testIn scope2026-11-14
staging-api.configurator.logitech.comapi, stagingIn scope2026-11-14
wss-dev-api.dev.configurator.logitech.comapi, devIn scope2026-11-14
api.arena.logitech.com.cnapiNot in the scope2026-11-14
gtm-api.logitechstore.com.brapiNot in the scope2026-11-14
api.myharmony.comapiIn scope2026-11-14
api.playmaster.ggapiNot in the scope2026-11-14
api-id.streamlabs.comapiIn scope2026-11-14
points-api.streamlabs.comapiIn scope2026-11-14
www.api-id.streamlabs.comapiIn scope2026-11-14
chatbot-api.streamlabs.comapiIn scope2026-11-14
restream-api.streamlabs.comapiIn scope2026-11-14
api-crossclip.streamlabs.comapiIn scope2026-11-14
api-crossclip-tc.streamlabs.comapiIn scope2026-11-14
chatbot-api-beta.streamlabs.comapi, stagingIn scope2026-11-14
crossclip-api-tc.streamlabs.comapiIn scope2026-11-14
marketplace-api-staging.streamlabs.comapi, stagingIn scope2026-11-14
api.teambeyond.netapiNot in the scope2026-11-14
admin-api.teambeyond.netadmin, apiNot in the scope2026-11-14
admin.api.teambeyond.netadmin, apiNot in the scope2026-11-14

1,405 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in