Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
No valid SPF record not found#771028	Duplicate	Authentication	–	2020-11-16	–	2
Session misconfiguration on forget password feature at https://ort-admin.pingone.com#659957	Valid	Authentication	Low	2020-11-16	–	8
Forbidden access to https://apps-staging.pingone.com but "/packages.json" visible and full path disclosureAnalysed#770711	Valid	Access Control	Low	2020-11-16	$100	14
Session misconfiguration on change password feature at https://apps-staging.pingone.com/myaccount/?environmentId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx#Analysed#643731	Valid	Misconfiguration and Insecure Design	Low	2020-11-16	–	16
Internal Hostname disclosure from multiple Apache servers via blank host header methodAnalysed#548094	Valid	Information Disclosure	Low	2020-03-12	$150	21
Google Maps API key leaked during device pairingAnalysed#724039	Valid	Information Disclosure	Medium	2020-04-28	$150	24
Stored XSS in Application menu via Home Page UrlAnalysed#797754	Valid	Cross-site Scripting	Medium	2020-11-16	–	24

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.