Bug bounty program
MG
MTN Group
Most upvoted reports128
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| SQL Injection on cookie parameterAnalysed#761304 | SQL Injection | 2020-05-03 | – | 323 |
| SQLi | in URL pathsAnalysed#2958619 | SQL Injection | 2025-03-06 | – | 149 |
| IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage.Analysed#1773609 | Insecure Direct Object Reference | 2024-10-05 | – | 135 |
| Yet Another OTP code Leaked in the API ResponseAnalysed#2635315 | Authentication | 2025-01-08 | – | 135 |
| FULL ACCOUNT TAKEOVERAnalysed#2542372 | No weakness recorded | 2024-08-17 | – | 123 |
| SQL injection in URL path leads to Database AccessAnalysed#2633959 | SQL Injection | 2025-01-08 | – | 115 |
| Authentication Bypass Leads To Complete Account TakeveOver on ██████████Analysed#1709881 | Authentication | 2024-09-14 | – | 109 |
| DOM Based Reflected Cross Site ScriptingAnalysed#2321874 | Cross-site Scripting | 2024-12-25 | – | 104 |
| Reflected cross site scripting (XSS) attacks Reflected XSS attacks,Analysed#1799197 | Cross-site Scripting | 2024-08-30 | – | 100 |
| Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)Analysed#2762462 | Authentication | 2025-03-04 | – | 98 |
Subdomains214,285
| Name | Scope | First seen |
|---|---|---|
| api.mtn.comapi | In scope | 2026-11-14 |
| ng.api.mtn.comapi | Not in the scope | 2026-11-14 |
| dr2.api.mtn.comapi | Not in the scope | 2026-11-14 |
| kp-api-docs.mtn.comapi | Not in the scope | 2026-11-14 |
| nigeria.api.mtn.comapi | Not in the scope | 2026-11-14 |
| nigeria2.api.mtn.comapi | Not in the scope | 2026-11-14 |
| api.openshift.mtn.comapi | Not in the scope | 2026-11-14 |
| developer.api.mtn.comapi | Not in the scope | 2026-11-14 |
| developers.api.mtn.comapi | Not in the scope | 2026-11-14 |
| za-preprod.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| coe-preprod.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| dev-nigeria.api.mtn.comapi, dev | Not in the scope | 2026-11-14 |
| grpc.cli-dev.my.mtn.comapi, dev | Not in the scope | 2026-11-14 |
| grpc.ser-dev.my.mtn.comapi, dev | Not in the scope | 2026-11-14 |
| api.studio.kente.mtn.comapi | Not in the scope | 2026-11-14 |
| efris.uganda.api.mtn.comapi | Not in the scope | 2026-11-14 |
| mtls-nigeria.api.mtn.comapi | Not in the scope | 2026-11-14 |
| api.ecogenie-mtnn.mtn.comapi | Not in the scope | 2026-11-14 |
| apps.prod.nga.api.mtn.comapi | Not in the scope | 2026-11-14 |
| prod2-nigeria.api.mtn.comapi | Not in the scope | 2026-11-14 |
| prod4-nigeria.api.mtn.comapi | Not in the scope | 2026-11-14 |
| prod5-nigeria.api.mtn.comapi | Not in the scope | 2026-11-14 |
| prod6-nigeria.api.mtn.comapi | Not in the scope | 2026-11-14 |
| za-preprod-tw.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| api.prod01.gha.api.mtn.comapi | Not in the scope | 2026-11-14 |
| api.prod01.nga.api.mtn.comapi | Not in the scope | 2026-11-14 |
| api.prod01.rwa.api.mtn.comapi | Not in the scope | 2026-11-14 |
| api.prod01.uga.api.mtn.comapi | Not in the scope | 2026-11-14 |
| api.prod02.uga.api.mtn.comapi | Not in the scope | 2026-11-14 |
| infra.apps.nga.api.mtn.comapi | Not in the scope | 2026-11-14 |
| uga.monitoring.api.mtn.comapi, monitoring | Not in the scope | 2026-11-14 |
| api.prod01b.uga.api.mtn.comapi | Not in the scope | 2026-11-14 |
| api.prod02b.uga.api.mtn.comapi | Not in the scope | 2026-11-14 |
| api.staging.gha.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| api.staging.uga.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| apps.prod01.gha.api.mtn.comapi | Not in the scope | 2026-11-14 |
| apps.prod01.nga.api.mtn.comapi | Not in the scope | 2026-11-14 |
| apps.prod01.uga.api.mtn.comapi | Not in the scope | 2026-11-14 |
| apps.prod02.uga.api.mtn.comapi | Not in the scope | 2026-11-14 |
| blob-api-prod.sz-my.mtn.comapi | Not in the scope | 2026-11-14 |
| dev.northeurope.api.mtn.comapi, dev | Not in the scope | 2026-11-14 |
| nigeria-preprod.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| preprod-nigeria.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| shop-api-prod.sz-my.mtn.comapi | Not in the scope | 2026-11-14 |
| staging-nigeria.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| za-preprod-sit1.api.mtn.comapi, staging, test | Not in the scope | 2026-11-14 |
| za-preprod-sit2.api.mtn.comapi, staging, test | Not in the scope | 2026-11-14 |
| analytics-api-dev.my.mtn.comapi, dev | Not in the scope | 2026-11-14 |
| apps.preprod.nga.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| apps.prod01b.uga.api.mtn.comapi | Not in the scope | 2026-11-14 |
| apps.prod02b.uga.api.mtn.comapi | Not in the scope | 2026-11-14 |
| apps.staging.gha.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| apps.staging.nga.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| apps.staging.uga.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| preprod2-nigeria.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| api.staging01.nga.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| api.staging02.uga.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| pcf.sandbox.miami.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| apps.staging01.nga.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| apps.staging02.uga.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| profile-api-prod.sz-my.mtn.comapi | Not in the scope | 2026-11-14 |
| www.api.prod01.nga.api.mtn.comapi | Not in the scope | 2026-11-14 |
| identity-api-prod.sz-my.mtn.comapi, auth | Not in the scope | 2026-11-14 |
| pcf.prod.westeurope.api.mtn.comapi | Not in the scope | 2026-11-14 |
| mtls-preprod-nigeria.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| pcf.preprod.zaf.dojo.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| prod.prod.westeurope.api.mtn.comapi | Not in the scope | 2026-11-14 |
| grafana.apps.prod.nga.api.mtn.comapi, monitoring | Not in the scope | 2026-11-14 |
| infra.prod.westeurope.api.mtn.comapi | Not in the scope | 2026-11-14 |
| www.api.staging01.nga.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| argocd.dev.northeurope.api.mtn.comapi, ci, dev | Not in the scope | 2026-11-14 |
| argocd.uat.northeurope.api.mtn.comapi, ci, test | Not in the scope | 2026-11-14 |
| dev.preprod.westeurope.api.mtn.comapi, dev, staging | Not in the scope | 2026-11-14 |
| dex.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| harbor.prod.westeurope.api.mtn.comapi, tools | Not in the scope | 2026-11-14 |
| pcf-sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| pcf.preprod.westeurope.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| pcf.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| pfc.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| pksapi.prod.westeurope.api.mtn.comapi | Not in the scope | 2026-11-14 |
| rabbitmq.apps.prod.nga.api.mtn.comapi, data | Not in the scope | 2026-11-14 |
| argocd.prod.northeurope.api.mtn.comapi, ci | Not in the scope | 2026-11-14 |
| grafana.apps.prod01.nga.api.mtn.comapi, monitoring | Not in the scope | 2026-11-14 |
| grafana.prod.westeurope.api.mtn.comapi, monitoring | Not in the scope | 2026-11-14 |
| pcf.control-plane.miami.api.mtn.comapi | Not in the scope | 2026-11-14 |
| sandbox.westeurope.dojo.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| api.cluster-01.az-euwest.api.mtn.comapi | Not in the scope | 2026-11-14 |
| grafana.apps.preprod.nga.api.mtn.comapi, monitoring, staging | Not in the scope | 2026-11-14 |
| infra.preprod.westeurope.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| infra.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| pcf.prod.westeurope.dojo.api.mtn.comapi | Not in the scope | 2026-11-14 |
| sandbox.southafricanorth.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| wildcard.apps.prod01.gha.api.mtn.comapi | Not in the scope | 2026-11-14 |
| argocd.sandbox.westeurope.api.mtn.comapi, ci, test | Not in the scope | 2026-11-14 |
| dex.infra.prod.westeurope.api.mtn.comapi | Not in the scope | 2026-11-14 |
| harbor.preprod.westeurope.api.mtn.comapi, staging, tools | Not in the scope | 2026-11-14 |
| harbor.sandbox.westeurope.api.mtn.comapi, test, tools | Not in the scope | 2026-11-14 |
| pksapi.preprod.westeurope.api.mtn.comapi, staging | Not in the scope | 2026-11-14 |
| pksapi.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| prod-mtls.apps.prod01.rwa.api.mtn.comapi | Not in the scope | 2026-11-14 |
28 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.