Skip to content
Connect AISign inSign up free

Bug bounty program

VI

Vimeo

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
30
Disclosed reports
71
Subdomains
10,008

Most upvoted reports71

All reports
Most upvoted reports of Vimeo
ReportWeaknessDisclosedBountyVotes
SSRF leaking internal google cloud data through upload function [SSH Keys, etc..]Analysed#549882Server-Side Request Forgery2019-12-13–276
Domain pointing to vimeo portfolio are prone to takeover using on-demand.Analysed#387307Input Validation and Logic2018-08-27–77
Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tvAnalysed#452559Access Control2019-07-10–76
Improper Authentication in Vimeo's API 'versions' endpoint.Analysed#328724Authentication2018-05-15–64
Reflected File Download (RFD) in download videoAnalysed#378941No weakness recorded2019-08-23–60
Watch any Password Video without passwordAnalysed#155618Information Disclosure2017-10-18–44
Downloading password protected / restricted videosAnalysed#145467No weakness recorded2016-09-05–43
All Vimeo Private videos disclosure via Authorization BypassAnalysed#137502Information Disclosure2016-07-29–35
Vimeo.com Insecure Direct Object References Reset PasswordAnalysed#42587Authentication2015-02-26–33
Make API calls on behalf of another user (CSRF protection bypass)Analysed#44146Cross-Site Request Forgery2015-01-22–33

Subdomains10,008

Root
Scope:In scope
Name suggests:API
First seen
Text fileClear filters46 names
Subdomains of Vimeo
NameScopeFirst seen
api.magisto.comapiIn scope2026-11-14
www.api.magisto.comapiIn scope2026-11-14
api.epsilon.magisto.comapiIn scope2026-11-14
api.nightly.magisto.comapiIn scope2026-11-14
api.sandbox.magisto.comapi, testIn scope2026-11-14
api.staging.magisto.comapi, stagingIn scope2026-11-14
api.vhx.tvapiIn scope2026-11-14
sa-api.vhx.tvapiIn scope2026-11-14
cdq-api.vhx.tvapiIn scope2026-11-14
cim-api.vhx.tvapiIn scope2026-11-14
cim-api-qa.vhx.tvapi, testIn scope2026-11-14
vendor-api.vhx.tvapiIn scope2026-11-14
api.cofiles.vhx.tvapiIn scope2026-11-14
cim-api-dev.vhx.tvapi, devIn scope2026-11-14
cim-api-uat.vhx.tvapi, testIn scope2026-11-14
cofiles-api.vhx.tvapiIn scope2026-11-14
ks-order-api.vhx.tvapiIn scope2026-11-14
ks-limits-api.vhx.tvapiIn scope2026-11-14
ks-invoice-api.vhx.tvapiIn scope2026-11-14
ks-program-api.vhx.tvapiIn scope2026-11-14
gws-api-sandbox.vhx.tvapi, testIn scope2026-11-14
ks-inventory-api.vhx.tvapiIn scope2026-11-14
api.nakednewsuncovered.vhx.tvapiIn scope2026-11-14
api-autilityponeocovid19-sa.vhx.tvapiIn scope2026-11-14
api.autilityponeocovid19-sa.vhx.tvapiIn scope2026-11-14
api.componeocovidevdemon.sa.vhx.tvapiIn scope2026-11-14
autilityponeocovid19-sa-api.vhx.tvapiIn scope2026-11-14
componeocovidevdemon-api.sa.vhx.tvapiIn scope2026-11-14
componeocovidevdemon.sa-api.vhx.tvapiIn scope2026-11-14
api-coronavirus-warning-banner.cofiles.vhx.tvapiIn scope2026-11-14
api.coronavirus-warning-banner.cofiles.vhx.tvapiIn scope2026-11-14
coronavirus-warning-banner.api.cofiles.vhx.tvapiIn scope2026-11-14
coronavirus-warning-banner.cofiles-api.vhx.tvapiIn scope2026-11-14
api.vimeo.comapiIn scope2026-11-14
www.api.vimeo.comapiIn scope2026-11-14
test.api.vimeo.comapi, testIn scope2026-11-14
api.cloud.vimeo.comapiIn scope2026-11-14
api.create.vimeo.comapiIn scope2026-11-14
api.venues.vimeo.comapiIn scope2026-11-14
custom.api.vimeo.comapiIn scope2026-11-14
live-api.cloud.vimeo.comapiIn scope2026-11-14
admin-api.venues.vimeo.comadmin, apiIn scope2026-11-14
live-api-dev.cloud.vimeo.comapi, devIn scope2026-11-14
live-api-dev2.cloud.vimeo.comapi, devIn scope2026-11-14
public.live-api.cloud.vimeo.comapiIn scope2026-11-14
public.live-api-dev.cloud.vimeo.comapi, devIn scope2026-11-14

9,323 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated