Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

NiceHash Mining platform bug bounty programs

nicehash.com Updated

NiceHash Mining platform runs one public program: a HackenProof bug bounty paying up to $25,000.

Top reward
$25,000
HackenProof
Programs
1
1 pays cash
Targets in scope
4
4 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program NiceHash Mining platform runs.

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

4 targets. 3 excluded.

  • test.nicehash.com

    Domains

  • https://api-test.nicehash.com

    APIs

  • https://play.google.com/store/apps/details?id=com.nicehash.metallum&hl=en

    Android

  • https://apps.apple.com/si/app/nicehash/id1372054956

    iOS

No target matches. Try part of a host name, such as the company name.

Out of scope 3

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • https://github.com/nicehash/NHOS

  • https://github.com/nicehash/NiceHashMiner

  • https://github.com/nicehash/NiceHashQuickMiner

Recent changes

Reward and scope changes across every NiceHash Mining platform program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in NiceHash Mining platform products, from the NVD.

Search NVD
  • CVE-2025-56513 Critical

    NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An attacker capable of intercepting or redirecting traffic to the update url and can hijack the update process and deliver arbitrary executables that are automatically executed, resulting in full remote code execution. This constitutes a critical supply chain attack vector. NOTE: the

  • CVE-2019-6120 High

    An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 (Username Enumeration) an adversary can enumerate a large number of valid users' Email addresses.

  • CVE-2019-6121 Low

    An issue was discovered in NiceHash Miner before 2.0.3.0. Missing Authorization allows an adversary to can gain access to a miner's information about such as his recent payments, unclaimed Balance, Old Balance (at the time of December 2017 breach) , Projected payout, Mining stats like profitability, Efficiency, Number of workers, etc.. A valid Email address is required in order to retrieve this In

  • CVE-2019-6122 Low

    A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address.

About this page

This page gathers every public program listed under nicehash.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.