Bug bounty program

Ping Identity

Platform: HackerOne
Bounties: Pays
Assets in scope: 10
Disclosed reports: 8
Subdomains: 1,669

Most upvoted reports8

Most upvoted reports of Ping Identity
Report	Weakness	Disclosed	Bounty	Votes
Google Maps API key leaked during device pairing#724039	Information Disclosure	2020-04-28	$150	24
Stored XSS in Application menu via Home Page Url#797754	Cross-site Scripting	2020-11-16	–	24
Broken Link on Ping Identity's Vulnerability Submission Form on Hackerone#1225299	Misconfiguration and Insecure Design	2021-06-16	–	22
Internal Hostname disclosure from multiple Apache servers via blank host header method#548094	Information Disclosure	2020-03-12	$150	21
Session misconfiguration on change password feature at https://apps-staging.pingone.com/myaccount/?environmentId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx##643731	Misconfiguration and Insecure Design	2020-11-16	–	16
Forbidden access to https://apps-staging.pingone.com but "/packages.json" visible and full path disclosure#770711	Access Control	2020-11-16	$100	14
Session misconfiguration on forget password feature at https://ort-admin.pingone.com#659957	Authentication	2020-11-16	–	8
No valid SPF record not found#771028	Authentication	2020-11-16	–	2

Subdomains1,669

Root:pingone.com

pingone.com1,669

Scope

Name suggests:Source code

First seen

Text fileClear filters6 names

Subdomains of Ping Identity
Name	Scope	First seen
gitlab.apps-staging.pingone.comgit, staging	Not in the scope	2026-11-14
git.pingone.comgit	Not in the scope	2026-11-14
gitlab.pingone.comgit	Not in the scope	2026-11-14
git.ort-admin.pingone.comadmin, git	Not in the scope	2026-11-14
gitlab.ort-admin.pingone.comadmin, git	Not in the scope	2026-11-14
gitlab.ort-authenticator.pingone.comgit	Not in the scope	2026-11-14

3 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.