Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
42
Disclosed reports
13
Subdomains
17,149
Vendor on CyberSIXT
Paypal (21 CVEs, 0 exploited)

Most upvoted reports13

All reports
Most upvoted reports of PayPal
ReportWeaknessDisclosedBountyVotes
Bypass for #488147 enables stored XSS on https://paypal.com/signin againAnalysed#510152Injection and Smuggling2019-08-07$20,0002,687
Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordAnalysed#739737Authentication2020-01-08$15,3001,409
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#925585Command and Code Injection2021-02-09$30,000946
DoS on PayPal via web cache poisoningAnalysed#622122Denial of Service2019-10-23$9,700851
IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersAnalysed#415081Insecure Direct Object Reference2019-07-30$10,500797
Stored XSS on https://paypal.com/signin via cache poisoningAnalysed#488147Injection and Smuggling2019-08-07$18,900685
[PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443Open Redirect2019-02-07–188
[Venmo Android] Remote theft of user sessionAnalysed#401940Open Redirect2019-02-07–151
Reflected XSS at https://www.paypal.com/ppcreditapply/da/usAnalysed#753835Cross-site Scripting2020-05-19–137
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)Analysed#425200Cross-site Scripting2018-11-06–100

Subdomains17,149

Subdomains of PayPal
NameScopeFirst seen
dev.braintree-api.comdevIn scope2026-11-14
aegis-proxy.dev.braintree-api.comdevIn scope2026-11-14
airflow.dev.braintree-api.comdev, toolsIn scope2026-11-14
analytics-dev-ap-southeast-2.dev.braintree-api.comdevIn scope2026-11-14
analytics-dev-us-east-2.dev.braintree-api.comdevIn scope2026-11-14
analytics-qa-eu-central-1.dev.braintree-api.comdev, testIn scope2026-11-14
application-inventory-qa-us-east-2.dev.braintree-api.comdev, testIn scope2026-11-14
application-inventory-qa-us-west-2.dev.braintree-api.comdev, testIn scope2026-11-14
arbiter-kubernetes-qa.dev.braintree-api.comdev, test, toolsIn scope2026-11-14
arbiter-kubernetes-qa-ap-south-1.dev.braintree-api.comdev, test, toolsIn scope2026-11-14
arbiter-kubernetes-qa-us-west-2.dev.braintree-api.comdev, test, toolsIn scope2026-11-14
artifactory-dev-us-east-2.dev.braintree-api.comdev, toolsIn scope2026-11-14
atmosphere-dev-us-east-1.dev.braintree-api.comdevIn scope2026-11-14
atmosphere-dev-us-west-2.dev.braintree-api.comdevIn scope2026-11-14
atmosphere-qa-ap-southeast-2.dev.braintree-api.comdev, testIn scope2026-11-14
atmosphere-qa-eu-central-1.dev.braintree-api.comdev, testIn scope2026-11-14
atmosphere-qa-us-east-1.dev.braintree-api.comdev, testIn scope2026-11-14
atmosphere-qa-us-west-2.dev.braintree-api.comdev, testIn scope2026-11-14
bcoumes.dev.braintree-api.comdevIn scope2026-11-14
bin-pentest2-us-east-1.dev.braintree-api.comdevIn scope2026-11-14
blue-front-door-cisb27-us-east-2.dev.braintree-api.comdevIn scope2026-11-14
blue-front-door-dev-us-east-2.dev.braintree-api.comdevIn scope2026-11-14
blue-front-door-pentest2-us-east-1.dev.braintree-api.comdevIn scope2026-11-14
blue-front-door-pentest2-us-east-2.dev.braintree-api.comdevIn scope2026-11-14
blue-front-door-pentest2-us-west-2.dev.braintree-api.comdevIn scope2026-11-14
blue-front-door-qa.dev.braintree-api.comdev, testIn scope2026-11-14
blue-front-door-qa-us-east-1.dev.braintree-api.comdev, testIn scope2026-11-14
blue-front-door-qa-us-east-2.dev.braintree-api.comdev, testIn scope2026-11-14
blue-front-door-qa-us-west-2.dev.braintree-api.comdev, testIn scope2026-11-14
brainiac-qa-us-east-2.dev.braintree-api.comdev, testIn scope2026-11-14
brisk-http-dev-us-west-2.dev.braintree-api.comdevIn scope2026-11-14
brisk-http-qa-us-west-2.dev.braintree-api.comdev, testIn scope2026-11-14
bt-calendar-dev-us-west-2.dev.braintree-api.comdevIn scope2026-11-14
cdn-a.dev.braintree-api.comdevIn scope2026-11-14
ci-dev.dev.braintree-api.comci, devIn scope2026-11-14
ci-qa.dev.braintree-api.comci, dev, testIn scope2026-11-14
demo-app-altpay-qa-us-west-2.dev.braintree-api.comdev, testIn scope2026-11-14
directory.dev.braintree-api.comdevIn scope2026-11-14
dockerhub-us-east-2.dev.braintree-api.comdevIn scope2026-11-14
dockerhub-us-west-2.dev.braintree-api.comdevIn scope2026-11-14
docs-qa-ap-southeast-2.dev.braintree-api.comdev, testIn scope2026-11-14
docs-qa-eu-central-1.dev.braintree-api.comdev, testIn scope2026-11-14
docs-qa-us-east-1.dev.braintree-api.comdev, testIn scope2026-11-14
docs-qa-us-east-2.dev.braintree-api.comdev, testIn scope2026-11-14
docs-qa-us-west-2.dev.braintree-api.comdev, testIn scope2026-11-14
doorman-dev-us-west-2.dev.braintree-api.comdevIn scope2026-11-14
doorman-qa-us-west-1.dev.braintree-api.comdev, testIn scope2026-11-14
doorman-qa-us-west-2.dev.braintree-api.comdev, testIn scope2026-11-14
drake-lyrics-qa-us-east-1.dev.braintree-api.comdev, testIn scope2026-11-14
environmentalist.dev.braintree-api.comdevIn scope2026-11-14
externalauth-qa-us-west-2.dev.braintree-api.comdev, testIn scope2026-11-14
falcon-dev-ap-southeast-2.dev.braintree-api.comdevIn scope2026-11-14
falcon-dev-eu-central-1.dev.braintree-api.comdevIn scope2026-11-14
falcon-dev-us-east-1.dev.braintree-api.comdevIn scope2026-11-14
falcon-dev-us-east-1-eks.dev.braintree-api.comdevIn scope2026-11-14
falcon-dev-us-east-2.dev.braintree-api.comdevIn scope2026-11-14
falcon-dev-us-east-2-eks.dev.braintree-api.comdevIn scope2026-11-14
falcon-dev-us-west-1.dev.braintree-api.comdevIn scope2026-11-14
falcon-dev-us-west-2.dev.braintree-api.comdevIn scope2026-11-14
falcon-dev-us-west-2-eks.dev.braintree-api.comdevIn scope2026-11-14
falcon-qa-ap-southeast-2.dev.braintree-api.comdev, testIn scope2026-11-14
falcon-qa-eu-central-1.dev.braintree-api.comdev, testIn scope2026-11-14
falcon-qa-us-east-1.dev.braintree-api.comdev, testIn scope2026-11-14
falcon-qa-us-east-1-eks.dev.braintree-api.comdev, testIn scope2026-11-14
falcon-qa-us-east-2.dev.braintree-api.comdev, testIn scope2026-11-14
falcon-qa-us-east-2-eks.dev.braintree-api.comdev, testIn scope2026-11-14
falcon-qa-us-west-1.dev.braintree-api.comdev, testIn scope2026-11-14
falcon-qa-us-west-2.dev.braintree-api.comdev, testIn scope2026-11-14
falcon-qa-us-west-2-eks.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-cosmos-qa-us-east-2.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-lb-qa.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-ap-east-1.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-ap-northeast-1.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-ap-northeast-2.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-ap-south-1.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-ap-southeast-1.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-ap-southeast-2.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-ca-central-1.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-eu-central-1.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-eu-north-1.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-eu-west-1.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-eu-west-2.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-eu-west-3.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-ga.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-sa-east-1.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-us-east-1.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-us-east-2.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-us-west-1.dev.braintree-api.comdev, testIn scope2026-11-14
gateway-qa-us-west-2.dev.braintree-api.comdev, testIn scope2026-11-14
datacenter.gateway-qa.dev.braintree-api.comdev, testIn scope2026-11-14
origin-cloud-ingress.gateway-qa.dev.braintree-api.comdev, testIn scope2026-11-14
graphql.dev.braintree-api.comapi, devIn scope2026-11-14
huddle-sandbox.dev.braintree-api.comdev, testIn scope2026-11-14
jenkins.dev.braintree-api.comci, devIn scope2026-11-14
jenkinsdev.dev.braintree-api.comdevIn scope2026-11-14
jenkinsqa.dev.braintree-api.comdevIn scope2026-11-14
k8s-dashboard.dev.braintree-api.comadmin, dev, toolsIn scope2026-11-14
k8s-dashboard-dev-ap-south-1.dev.braintree-api.comadmin, dev, toolsIn scope2026-11-14
k8s-dashboard-dev-ap-southeast-2.dev.braintree-api.comadmin, dev, toolsIn scope2026-11-14

17,017 names are covered by the program's own scope; 3 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.