Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Majid Al Futtaim Fashion bug bounty programs

majidalfuttaim.com Updated

Majid Al Futtaim Fashion runs three public programs: a Bugcrowd bug bounty paying up to $3,500, a Bugcrowd bug bounty paying up to $3,000 and a self-hosted bug bounty. 2 companies it owns, including carrefouruae.com and voxcinemas.com, run 2 more programs.

Top reward
$4,000
carrefouruae.com, Bugcrowd
Programs
5
5 pay cash
Targets in scope
49
4 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

3 programs Majid Al Futtaim Fashion runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Majid Al Futtaim

Self-hosted · The company-wide program. Use it when no owned company's program fits.
  • Majid Al Futtaim Lifestyle

    Bugcrowd · Bug bounty

    Open

    Top reward

    $3,500
    Critical
    $3,500 (highest)
    High
    $2,500 (highest)
    Medium
    $1,000 (highest)
    Low
    –
    Safe harbor
    Full
  • Majid Al Futtaim Customer Solutions

    Bugcrowd · Bug bounty

    Open

    Top reward

    $3,000
    Critical
    $2,500
    High
    $1,500
    Medium
    $749
    Low
    –
    Safe harbor
    Full
  • Majid Al Futtaim

    Self-hosted · Bug bounty

    Open

    Top reward

    Not published
    Safe harbor
    None

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

Companies Majid Al Futtaim Fashion owns

2 companies with 2 programs of their own. Each has its own scope and rules: report to the one that owns the asset.

What is in scope

49 targets across all 5 programs, each listed once with the programs that cover it. 3 excluded.

No target matches. Try part of a host name, such as the company name.

Out of scope 3

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • http://www.theplaymania.com

    Majid Al Futtaim Entertainment

  • https://cwingsfe.mafrservices.com/login

    Majid Al Futtaim Retail

  • www.americangirlmena.com

    Majid Al Futtaim Lifestyle

Recent changes

Reward and scope changes across every Majid Al Futtaim Fashion program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Majid Al Futtaim Fashion products, from the NVD.

Search NVD
  • CVE-2026-42280 High

    Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.

  • CVE-2026-40155 Medium

    The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enab

  • CVE-2026-34236 High

    Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0.

  • CVE-2025-68129 Medium

    Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that

  • CVE-2025-67716 Medium

    The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fix

  • CVE-2025-67490 Medium

    The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.

  • CVE-2025-65945 High

    auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected h

  • CVE-2022-23539 Medium

    Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0

About this page

This page gathers every public program listed under majidalfuttaim.com and the companies Majid Al Futtaim Fashion owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Majid Al Futtaim Fashion.

Something wrong or missing? Report a correction.