Bug bounty program
MG
MTN Group
Most upvoted reports128
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| SQL Injection on cookie parameterAnalysed#761304 | SQL Injection | 2020-05-03 | – | 323 |
| SQLi | in URL pathsAnalysed#2958619 | SQL Injection | 2025-03-06 | – | 149 |
| IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage.Analysed#1773609 | Insecure Direct Object Reference | 2024-10-05 | – | 135 |
| Yet Another OTP code Leaked in the API ResponseAnalysed#2635315 | Authentication | 2025-01-08 | – | 135 |
| FULL ACCOUNT TAKEOVERAnalysed#2542372 | No weakness recorded | 2024-08-17 | – | 123 |
| SQL injection in URL path leads to Database AccessAnalysed#2633959 | SQL Injection | 2025-01-08 | – | 115 |
| Authentication Bypass Leads To Complete Account TakeveOver on ██████████Analysed#1709881 | Authentication | 2024-09-14 | – | 109 |
| DOM Based Reflected Cross Site ScriptingAnalysed#2321874 | Cross-site Scripting | 2024-12-25 | – | 104 |
| Reflected cross site scripting (XSS) attacks Reflected XSS attacks,Analysed#1799197 | Cross-site Scripting | 2024-08-30 | – | 100 |
| Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)Analysed#2762462 | Authentication | 2025-03-04 | – | 98 |
Subdomains214,285
| Name | Scope | First seen |
|---|---|---|
| mtndxp-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| blob.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| help.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| mykente-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| shop.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| uat.auth.za.mtn.comauth, test | Not in the scope | 2026-11-14 |
| ghmtnone-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| ugmtnone-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| config.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| gamifyhub-sit.mtn.comtest | Not in the scope | 2026-11-14 |
| mtn-id.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| mtnonecdn-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| pms-ui.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| profile.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| rewards.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| accounts.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| balances.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| bjmtnonecdn-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| bjmtnonedxp-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| cgmtnonecdn-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| cgmtnonedxp-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| cimtnonecdn-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| cimtnonedxp-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| cmmtnonecdn-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| cmmtnonedxp-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| ghmtnonecdn-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| ghmtnonedxp-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| products.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| sdmtnonecdn-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| sdmtnonedxp-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| swmtnonecdn-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| swmtnonedxp-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| ugmtnonecdn-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| ugmtnonedxp-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| zmmtnonecdn-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| zmmtnonedxp-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| analytics.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| ghamtnonecdn-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| ghamtnonedxp-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| mtnonedxpcdn-uat.mtn.comtest | Not in the scope | 2026-11-14 |
| uat.skillsacademy.mtn.comtest | Not in the scope | 2026-11-14 |
| exp-manager.sit-my.mtn.comadmin, test | Not in the scope | 2026-11-14 |
| tansactions.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| notification.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| subscription.sit-my.mtn.comtest | Not in the scope | 2026-11-14 |
| za-preprod-sit1.api.mtn.comapi, staging, test | Not in the scope | 2026-11-14 |
| za-preprod-sit2.api.mtn.comapi, staging, test | Not in the scope | 2026-11-14 |
| bss-uat-mtncs-za.tcoe.mtn.comtest | Not in the scope | 2026-11-14 |
| pcf.sandbox.miami.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| sandbox.momodeveloper.mtn.comtest | In scope | 2026-11-14 |
| argocd.uat.northeurope.api.mtn.comapi, ci, test | Not in the scope | 2026-11-14 |
| dex.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| pcf-sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| pcf.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| pfc.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| sandbox.westeurope.dojo.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| infra.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| sandbox.southafricanorth.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| argocd.sandbox.westeurope.api.mtn.comapi, ci, test | Not in the scope | 2026-11-14 |
| harbor.sandbox.westeurope.api.mtn.comapi, test, tools | Not in the scope | 2026-11-14 |
| pksapi.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| argocd.sandbox.northeurope.api.mtn.comapi, ci, test | Not in the scope | 2026-11-14 |
| grafana.sandbox.westeurope.api.mtn.comapi, monitoring, test | Not in the scope | 2026-11-14 |
| cluster1.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| dex.sandbox.westeurope.dojo.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| pcf.sandbox.westeurope.dojo.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| harbor.sandbox.westeurope.dojo.api.mtn.comapi, test, tools | Not in the scope | 2026-11-14 |
| pksapi.sandbox.westeurope.dojo.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| sandbox-test.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| bosh-exporter.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| cluster1.sandbox.westeurope.dojo.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| sandbox-infra.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| dex.sandbox-infra.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| test.sandbox-infra.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| nexus.sandbox-infra.sandbox.westeurope.api.mtn.comapi, test, tools | Not in the scope | 2026-11-14 |
| vault.sandbox-infra.sandbox.westeurope.api.mtn.comapi, test, tools | Not in the scope | 2026-11-14 |
| argocd.sandbox-infra.sandbox.westeurope.api.mtn.comapi, ci, test | Not in the scope | 2026-11-14 |
| wildcard.sandbox-test.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| wildcard.sandbox-infra.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| config-server.sandbox-infra.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
| dex-authenticator.sandbox-infra.sandbox.westeurope.api.mtn.comapi, test | Not in the scope | 2026-11-14 |
28 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.