Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
42
Disclosed reports
13
Subdomains
17,149
Vendor on CyberSIXT
Paypal (21 CVEs, 0 exploited)

Most upvoted reports13

All reports
Most upvoted reports of PayPal
ReportWeaknessDisclosedBountyVotes
Bypass for #488147 enables stored XSS on https://paypal.com/signin againAnalysed#510152Injection and Smuggling2019-08-07$20,0002,687
Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordAnalysed#739737Authentication2020-01-08$15,3001,409
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#925585Command and Code Injection2021-02-09$30,000946
DoS on PayPal via web cache poisoningAnalysed#622122Denial of Service2019-10-23$9,700851
IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersAnalysed#415081Insecure Direct Object Reference2019-07-30$10,500797
Stored XSS on https://paypal.com/signin via cache poisoningAnalysed#488147Injection and Smuggling2019-08-07$18,900685
[PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443Open Redirect2019-02-07–188
[Venmo Android] Remote theft of user sessionAnalysed#401940Open Redirect2019-02-07–151
Reflected XSS at https://www.paypal.com/ppcreditapply/da/usAnalysed#753835Cross-site Scripting2020-05-19–137
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)Analysed#425200Cross-site Scripting2018-11-06–100

Subdomains17,149

Subdomains of PayPal
NameScopeFirst seen
api-dev-sfx-observability.paypal.comapi, devIn scope2026-11-14
app-dev-ppcn-sfx-observability.paypal.comdevIn scope2026-11-14
backfill-dev-sfx-observability.paypal.comdevIn scope2026-11-14
buobservability-dev.paypal.comdevIn scope2026-11-14
dev.paypal.comdevIn scope2026-11-14
cosmosai-dev.dev51.cbf.dev.paypal.comdevIn scope2026-11-14
gcpdevsplunkcm1.pp-devcos-splunk.us-central1.gcp.dev.paypal.comdev, monitoringIn scope2026-11-14
gcpdevsplunkindex1.pp-devcos-splunk.us-central1.gcp.dev.paypal.comdev, monitoringIn scope2026-11-14
gcpdevsplunkindex2.pp-devcos-splunk.us-central1.gcp.dev.paypal.comdev, monitoringIn scope2026-11-14
gcpdevsplunkindex3.pp-devcos-splunk.us-central1.gcp.dev.paypal.comdev, monitoringIn scope2026-11-14
gcpdevsplunksrch1.pp-devcos-splunk.us-central1.gcp.dev.paypal.comdev, monitoringIn scope2026-11-14
gcpdevsplunksrch2.pp-devcos-splunk.us-central1.gcp.dev.paypal.comdev, monitoringIn scope2026-11-14
gcpdevsplunksrch3.pp-devcos-splunk.us-central1.gcp.dev.paypal.comdev, monitoringIn scope2026-11-14
pcs.dev.paypal.comdevIn scope2026-11-14
exp-dev-sfx-observability.paypal.comdevIn scope2026-11-14
dev.api.grid.paypal.comapi, devIn scope2026-11-14
dev.grid.paypal.comdevIn scope2026-11-14
ingest-dev-sfx-observability.paypal.comdevIn scope2026-11-14
localhost.paypal.comdevIn scope2026-11-14
looker-dev51-host.paypal.comdevIn scope2026-11-14
api-msmaster.meridian-dev.paypal.comapi, devIn scope2026-11-14
www.api-msmaster.meridian-dev.paypal.comapi, devIn scope2026-11-14
msmaster.meridian-dev.paypal.comdevIn scope2026-11-14
www.msmaster.meridian-dev.paypal.comdevIn scope2026-11-14
dev.offers.paypal.comdevIn scope2026-11-14
ej-dev.offers.paypal.comdevIn scope2026-11-14
airflow-dev-besx.qa.paypal.comdev, test, toolsIn scope2026-11-14
controlm-admin-dev-api.qa.paypal.comadmin, api, dev, testIn scope2026-11-14
controlm-admin-dev-api-1.qa.paypal.comadmin, api, dev, testIn scope2026-11-14
controlm-admin-dev-api-2.qa.paypal.comadmin, api, dev, testIn scope2026-11-14
controlm-admin-dev-api-3.qa.paypal.comadmin, api, dev, testIn scope2026-11-14
controlm-admin-dev-em.qa.paypal.comadmin, dev, testIn scope2026-11-14
controlm-admin-dev-em-sec.qa.paypal.comadmin, dev, testIn scope2026-11-14
controlmem-ss-api-dev.qa.paypal.comapi, dev, testIn scope2026-11-14
controlmem-ss-dev.qa.paypal.comdev, testIn scope2026-11-14
controlmem-ss-dev-sec.qa.paypal.comdev, testIn scope2026-11-14
daviddm-localhost3001.qa.paypal.comdev, testIn scope2026-11-14
dbserv-dev-vip.qa.paypal.comdev, testIn scope2026-11-14
definity-dev.qa.paypal.comdev, testIn scope2026-11-14
dev-classroom.qa.paypal.comdev, testIn scope2026-11-14
dev51dbtoolmcp02.qa.paypal.comdev, testIn scope2026-11-14
dev51fautgen01.qa.paypal.comdev, testIn scope2026-11-14
looker-dev51.qa.paypal.comdev, testIn scope2026-11-14
looker-dev51-host.qa.paypal.comdev, testIn scope2026-11-14
mockmgmtserv-dev-vip.qa.paypal.comdev, testIn scope2026-11-14
msgeo2dev51.qa.paypal.comdev, testIn scope2026-11-14
msgeo2dev52.qa.paypal.comdev, testIn scope2026-11-14
namespaceserv-dev-vip.qa.paypal.comdev, testIn scope2026-11-14
ntitanlogs-dev.qa.paypal.comdev, testIn scope2026-11-14
relapiserv-dev-vip.qa.paypal.comdev, testIn scope2026-11-14
relorchaserv-dev-vip.qa.paypal.comdev, testIn scope2026-11-14
rrvs-dev.qa.paypal.comdev, testIn scope2026-11-14
rrvsserv-dev.qa.paypal.comdev, testIn scope2026-11-14
www.stage2dev545.qa.paypal.comdev, staging, testIn scope2026-11-14
te-finappsexpresslaneapi-dev.qa.paypal.comdev, testIn scope2026-11-14
www.te-finappsexpresslaneapi-dev.qa.paypal.comdev, testIn scope2026-11-14
te-new-venmo-dev.qa.paypal.comdev, testIn scope2026-11-14
api.te-new-venmo-dev.qa.paypal.comapi, dev, testIn scope2026-11-14
www.te-new-venmo-dev.qa.paypal.comdev, testIn scope2026-11-14
www.te-plw-onboarding-dev.qa.paypal.comdev, testIn scope2026-11-14
www.te-plw-payments-dev.qa.paypal.comdev, testIn scope2026-11-14
te-watch-dev.qa.paypal.comdev, testIn scope2026-11-14
www.te-watch-dev.qa.paypal.comdev, testIn scope2026-11-14
teaserv-dev-vip.qa.paypal.comdev, testIn scope2026-11-14
titanlogs-dev.qa.paypal.comdev, testIn scope2026-11-14
trackmate-dev.qa.paypal.comdev, testIn scope2026-11-14
wukong-dev.qa.paypal.comdev, testIn scope2026-11-14
localhost.sandbox.paypal.comdev, testIn scope2026-11-14
credit-dev.stage.paypal.comdev, stagingIn scope2026-11-14
api.credit-dev.stage.paypal.comapi, dev, stagingIn scope2026-11-14
nwww.credit-dev.stage.paypal.comdev, stagingIn scope2026-11-14
www.credit-dev.stage.paypal.comdev, stagingIn scope2026-11-14
creditauciti-dev.stage.paypal.comdev, stagingIn scope2026-11-14
api.creditauciti-dev.stage.paypal.comapi, dev, stagingIn scope2026-11-14
www.creditauciti-dev.stage.paypal.comdev, stagingIn scope2026-11-14
dev51edge.stage.paypal.comdev, stagingIn scope2026-11-14
lfs-dev.stage.paypal.comdev, stagingIn scope2026-11-14
api.lfs-dev.stage.paypal.comapi, dev, stagingIn scope2026-11-14
nwww.lfs-dev.stage.paypal.comdev, stagingIn scope2026-11-14
www.lfs-dev.stage.paypal.comdev, stagingIn scope2026-11-14
stage2dev113.stage.paypal.comdev, stagingIn scope2026-11-14
api.stage2dev113.stage.paypal.comapi, dev, stagingIn scope2026-11-14
napi.stage2dev113.stage.paypal.comdev, stagingIn scope2026-11-14
nwww.stage2dev113.stage.paypal.comdev, stagingIn scope2026-11-14
www.stage2dev113.stage.paypal.comdev, stagingIn scope2026-11-14
stage2dev348.stage.paypal.comdev, stagingIn scope2026-11-14
api.stage2dev348.stage.paypal.comapi, dev, stagingIn scope2026-11-14
napi.stage2dev348.stage.paypal.comdev, stagingIn scope2026-11-14
nwww.stage2dev348.stage.paypal.comdev, stagingIn scope2026-11-14
www.stage2dev348.stage.paypal.comdev, stagingIn scope2026-11-14
stage2dev360.stage.paypal.comdev, stagingIn scope2026-11-14
api.stage2dev360.stage.paypal.comapi, dev, stagingIn scope2026-11-14
napi.stage2dev360.stage.paypal.comdev, stagingIn scope2026-11-14
nwww.stage2dev360.stage.paypal.comdev, stagingIn scope2026-11-14
www.stage2dev360.stage.paypal.comdev, stagingIn scope2026-11-14
stage2dev673.stage.paypal.comdev, stagingIn scope2026-11-14
api.stage2dev673.stage.paypal.comapi, dev, stagingIn scope2026-11-14
npaymon.stage2dev673.stage.paypal.comdev, stagingIn scope2026-11-14
nwww.stage2dev673.stage.paypal.comdev, stagingIn scope2026-11-14
paymon.stage2dev673.stage.paypal.comdev, stagingIn scope2026-11-14

17,017 names are covered by the program's own scope; 3 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.