Skip to content
Sign in

Bug bounty program

UI

Ubiquiti Inc.

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
53
Disclosed reports
98
Subdomains
65,487
Vendor on CyberSIXT
Ubiquiti Inc (145 CVEs, 4 exploited), Ui (54 CVEs, 0 exploited)

Most upvoted reports98

All reports
Most upvoted reports of Ubiquiti Inc.
ReportWeaknessDisclosedBountyVotes
Privilege Escalation From user to SYSTEM via unauthenticated command executionAnalysed#544928Command and Code Injection2019-11-08–553
Privilege-0 to Root Privilege Escalation on EdgeSwitch#511025Access Control2019-03-31–82
Public Jenkins instance with /script enabled#403402Command and Code Injection2018-09-10–74
Remote Code Execution at http://tw.corp.ubnt.com#269066Command and Code Injection2017-11-29–61
Subdomain takeover on partners.ubnt.com due to non-used CloudFront DNS entry#145224Access Control2016-11-27–57
CORS Misconfiguration leading to Private Information Disclosure#430249Access Control2019-06-07–57
Login as root without password on EdgeSwitchX#512958Authentication2019-03-31–56
Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com#172137Cross-Site Request Forgery2016-11-29–55
Ability to log in as any user without authentication if █████████ is empty#215053Authentication2017-08-08–54
Unrestricted File System Access via Twig Template Injection on dev-ucrm-billing-demo.ubnt.com#301406No weakness recorded2018-03-07–47

Subdomains65,487

Root
Scope
Name suggests:Sign-in
First seen
Text fileClear filters45 names
Subdomains of Ubiquiti Inc.
NameScopeFirst seen
dev-sso.ubnt.comauth, devIn scope2026-11-14
eu.dev-sso.ubnt.comauth, devIn scope2026-11-14
smtp-sso.ubnt.comauth, mailIn scope2026-11-14
sso.ubnt.comauthIn scope2026-11-14
sso-cn.ubnt.comauthIn scope2026-11-14
sso-stage.ubnt.comauth, stagingIn scope2026-11-14
stg-sso.ubnt.comauth, stagingIn scope2026-11-14
core-web-login.uid.alpha.ui.comauth, stagingIn scope2026-11-14
login.uid.alpha.ui.comauth, stagingIn scope2026-11-14
auth.blog.ui.comauthIn scope2026-11-14
iam.blog.ui.comauthIn scope2026-11-14
login.blog.ui.comauthIn scope2026-11-14
okta.blog.ui.comauthIn scope2026-11-14
signin.blog.ui.comauthIn scope2026-11-14
sso.blog.ui.comauthIn scope2026-11-14
a.auth-ns.17.8.2.03.accounts.12.brown.www.blog.dev.ui.comauth, devIn scope2026-11-14
sso.dev.ui.comauth, devIn scope2026-11-14
eu.sso.dev.ui.comauth, devIn scope2026-11-14
sso-api-failover.sso.dev.ui.comapi, auth, devIn scope2026-11-14
eu.sso-api-failover.sso.dev.ui.comapi, auth, devIn scope2026-11-14
api.identity.df.ui.comapi, authIn scope2026-11-14
login.uid.df.ui.comauthIn scope2026-11-14
identity.ui.comauthIn scope2026-11-14
api.identity.ui.comapi, authIn scope2026-11-14
df.identity.ui.comauthIn scope2026-11-14
eu.identity.ui.comauthIn scope2026-11-14
sso.ui.comauthIn scope2026-11-14
sso-api-failover.sso.ui.comapi, authIn scope2026-11-14
sso.stg.ui.comauth, stagingIn scope2026-11-14
sso-api-failover.sso.stg.ui.comapi, auth, stagingIn scope2026-11-14
idp.dev.svc.ui.comauth, devIn scope2026-11-14
internal-idp.dev.svc.ui.comauth, dev, internalIn scope2026-11-14
login.dev.svc.ui.comauth, devIn scope2026-11-14
sso.dev.svc.ui.comauth, devIn scope2026-11-14
auth.uid.dev.svc.ui.comauth, devIn scope2026-11-14
identity.svc.ui.comauthIn scope2026-11-14
df.identity.svc.ui.comauthIn scope2026-11-14
eu.identity.svc.ui.comauthIn scope2026-11-14
idp.svc.ui.comauthIn scope2026-11-14
internal-idp.svc.ui.comauth, internalIn scope2026-11-14
sso.svc.ui.comauthIn scope2026-11-14
idp.stg.svc.ui.comauth, stagingIn scope2026-11-14
internal-idp.stg.svc.ui.comauth, internal, stagingIn scope2026-11-14
sso.stg.svc.ui.comauth, stagingIn scope2026-11-14
login.uid.ui.comauthIn scope2026-11-14

65,428 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in