Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Session misconfiguration on forget password feature at https://ort-admin.pingone.com#659957	Valid	Authentication	–	2020-11-16	–	8
Forbidden access to https://apps-staging.pingone.com but "/packages.json" visible and full path disclosure#770711	Valid	Access Control	–	2020-11-16	$100	14
Session misconfiguration on change password feature at https://apps-staging.pingone.com/myaccount/?environmentId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx##643731	Valid	Misconfiguration and Insecure Design	–	2020-11-16	–	16
Internal Hostname disclosure from multiple Apache servers via blank host header method#548094	Valid	Information Disclosure	–	2020-03-12	$150	21
Broken Link on Ping Identity's Vulnerability Submission Form on Hackerone#1225299	Valid	Misconfiguration and Insecure Design	–	2021-06-16	–	22
Google Maps API key leaked during device pairing#724039	Valid	Information Disclosure	–	2020-04-28	$150	24
Stored XSS in Application menu via Home Page Url#797754	Valid	Cross-site Scripting	–	2020-11-16	–	24

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.