Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

ASSA ABLOY Americas bug bounty programs

assaabloy.com Updated

ASSA ABLOY Americas runs one public program: a HackerOne disclosure program with no cash rewards.

Top reward
No cash
Disclosure only
Programs
1
None pays cash
Targets in scope
36
3 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program ASSA ABLOY Americas runs.

  • Assa Abloy Americas

    HackerOne · Disclosure only

    Open

    Top reward

    No cash
    Safe harbor
    Full
    First response
    27 hours average

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

36 targets.

  • adamsrite.com

    Web Critical No bounty

  • https://accentra.assaabloy.com

    Web Critical No bounty

  • https://bittings.medeco.com

    Web Critical No bounty

  • https://ca-roa.medeco.com

    Web Critical No bounty

  • https://controlid.com.br

    Web Critical No bounty

  • https://eacconfig.assaabloy.com

    Web Critical No bounty

  • https://goconcourse.com

    Web Critical No bounty

  • https://idsecure.com.br

    Web Critical No bounty

  • https://keycontrol.medeco.com

    Web Critical No bounty

  • https://knowledge.openingsstudio.com

    Web Critical No bounty

  • https://kwiksetunite.com

    Web Critical No bounty

  • https://level.co

    Web Critical No bounty

  • https://manage.openingsstudio.com

    Web Critical No bounty

  • https://roa.assaabloy.net

    Web Critical No bounty

  • https://roa.medeco.com

    Web Critical No bounty

  • https://test-bittings.medeco.com

    Web Critical No bounty

  • https://test-keycontrol.medeco.com

    Web Critical No bounty

  • https://test-roa.medeco.com

    Web Critical No bounty

  • https://yale.accentra.assaabloy.com

    Web Critical No bounty

  • https://yaleconnecthub.com

    Web Critical No bounty

  • https://yalelatinoamerica.com

    Web Critical No bounty

  • https://play.google.com/store/apps/details?id=br.com.controlid.rhid&hl=en&gl=US

    Android Critical No bounty

  • https://play.google.com/store/apps/details?id=co.level.app

    Android Critical No bounty

  • https://play.google.com/store/apps/details?id=com.assaabloy.accentra.access

    Android Critical No bounty

  • https://play.google.com/store/apps/details?id=com.assaabloy.centrIosAppStore

    Android Critical No bounty

No target matches. Try part of a host name, such as the company name.

Recent changes

Reward and scope changes across every ASSA ABLOY Americas program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in ASSA ABLOY Americas products, from the NVD.

Search NVD
  • CVE-2026-3315 Medium

    Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Visionline on Windows allows Configuration/Environment Manipulation.This issue affects Visionline: from 1.0 before 1.33.

  • CVE-2025-49851 High

    ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product.

  • CVE-2025-49852 High

    ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers.

  • CVE-2025-49853 Critical

    ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to SQL injections which could allow an attacker to leak arbitrary information and insert arbitrary SQL syntax into SQL queries.

  • CVE-2025-2125 Medium

    A vulnerability has been found in Control iD RH iD 25.2.25.0 and classified as problematic. This vulnerability affects unknown code of the file /v2/report.svc/comprovante_marcacao/?companyId=1 of the component PDF Document Handler. The manipulation of the argument nsr leads to improper control of resource identifiers. The attack can be initiated remotely. The vendor was contacted early about this

  • CVE-2023-26941 Medium

    Weak encryption mechanisms in RFID Tags in Yale Conexis L1 v1.1.0 allows attackers to create a cloned tag via physical proximity to the original.

  • CVE-2023-26942 Medium

    Weak encryption mechanisms in RFID Tags in Yale IA-210 Alarm v1.0 allows attackers to create a cloned tag via physical proximity to the original.

  • CVE-2023-26943 Medium

    Weak encryption mechanisms in RFID Tags in Yale Keyless Lock v1.0 allows attackers to create a cloned tag via physical proximity to the original.

About this page

This page gathers every public program listed under assaabloy.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.