Harman bug bounty programs
harman.com Updated
Harman runs one public program: a YesWeHack bug bounty paying up to €4,000.
- Top reward
- €4,000
- YesWeHack
- Programs
- 1
- 1 pays cash
- Targets in scope
- 25
- 4 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Harman runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Harman International Lifestyle Products & Services
YesWeHack · Bug bounty |
€4,000 | €2,500 | €1,000 | €300 | €4,000 | Full | – | 24 hours promised | Open |
-
- Critical
- €4,000
- High
- €2,500
- Medium
- €1,000
- Low
- €300
- Safe harbor
- Full
- First response
- 24 hours promised
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
25 targets. 2 excluded.
-
https://apis.onecloud.harman.com
APIs
-
https://bluetooth-events.onecloud.harman.com
APIs
-
https://edgeapis.onecloud.harman.com
APIs
-
https://events.onecloud.harman.com
APIs
-
https://ota.onecloud.harman.com
APIs
-
https://quantum-events.onecloud.harman.com
APIs
-
https://tms.onecloud.harman.com
APIs
-
https://play.google.com/store/apps/details?id=com.jbl.oneapp&hl=fr&gl=US
Android
-
https://apps.apple.com/fr/app/jbl-one/id1610239857
iOS
-
Device: JBL Authentics 200
Products and areas
-
Device: JBL Authentics 300
Products and areas
-
Device: JBL Authentics 500
Products and areas
-
Device: JBL Bar 1000MK2
Products and areas
-
Device: JBL Bar 1300MK2
Products and areas
-
Device: JBL Bar 300MK2
Products and areas
-
Device: JBL Bar 500MK2
Products and areas
-
Device: JBL Bar 700MK2
Products and areas
-
Device: JBL Bar 800MK2
Products and areas
-
Device: JBL Boombox 3 Wi-Fi
Products and areas
-
Device: JBL Charge 5
Products and areas
-
Device: JBL Charge 5 Wi-Fi
Products and areas
-
Device: JBL Flip 7
Products and areas
-
Device: JBL Live Beam 3
Products and areas
-
Device: JBL PartyBox Encore 2
Products and areas
-
Device: JBL Tour One M3
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 2
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
All domains or subdomains not listed in the above list of 'Scopes'
-
Mobile app versions that are not currently in app stores.
Recent changes
Reward and scope changes across every Harman program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Harman products, from the NVD.
-
CVE-2019-19560 Medium
An authentication bypass in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with physical access to device hardware to obtain system information.
-
CVE-2019-19561 Low
A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
-
CVE-2019-19562 Medium
An authentication bypass in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with physical access to device hardware to obtain system information.
-
CVE-2019-19563 Low
A misconfiguration in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
-
CVE-2019-19556 Medium
An authentication bypass in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with physical access to device hardware to obtain system information.
-
CVE-2019-19557 Low
A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
-
CVE-2019-11224 High
HARMAN AMX MVP5150 v2.87.13 devices allow remote OS Command Injection.
-
CVE-2016-1984 Critical
The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2016-01-20 has a hardcoded password for the 1MB@tMaN account, which makes it easier for remote attackers to obtain access via a (1) SSH or (2) HTTP session, a different vulnerability than CVE-2015-8362.
About this page
This page gathers every public program listed under harman.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.