Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Okta bug bounty programs

okta.com Updated

Okta runs one public program: a Bugcrowd bug bounty paying up to $75,000. It also owns Auth0, which runs 2 more programs.

Top reward
$75,000
Bugcrowd
Programs
3
3 pay cash
Targets in scope
47
8 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Okta runs itself.

  • Okta

    Bugcrowd · Bug bounty

    Open

    Top reward

    $75k
    Critical
    $75k
    High
    $10k
    Medium
    $4,000
    Low
    $1,000
    Safe harbor
    Full

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

Companies Okta owns

1 company with 2 programs of its own. Each has its own scope and rules: report to the one that owns the asset.

What is in scope

47 targets across all 3 programs, each listed once with the programs that cover it. 30 excluded.

No target matches. Try part of a host name, such as the company name.

Out of scope 30

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.okta.com

    Okta

  • *.trexcloud.com

    Okta

  • auth0.auth0.com

    Self-hosted Auth0 by Okta

  • community.auth0.com

    Self-hosted Auth0 by Okta

  • goextend.io

    Self-hosted Auth0 by Okta

  • phenix.rocks

    Self-hosted Auth0 by Okta

  • sharelock.io

    Self-hosted Auth0 by Okta

  • support.auth0.com

    Self-hosted Auth0 by Okta

  • accounts.auth0.com

    Auth0 by Okta Self-hosted

  • AtSpoke - Entitlement bundles as a resource in access requests

    Okta

  • AtSpoke - Okta Workflows actions in access requests

    Okta

  • Auth0 Docs (including quickstarts)

    Self-hosted Auth0 by Okta

  • bugcrowd-%username%-1.oktapreview.com

    Okta

  • bugcrowd-%username%-2.oktapreview.com

    Okta

  • developer.okta.com

    Okta

  • https://app.scaleft.com/p/signup

    Okta

  • https://github.com/oktadev

    Okta

  • https://scaleft.com

    Okta

  • https://support.auth0.com/tickets/new

    Self-hosted Auth0 by Okta

  • login.okta.com

    Okta

  • manage.auth0.com

    Auth0 by Okta Self-hosted

  • pages.okta.com

    Okta

  • personal.trexcloud.com

    Okta

  • trust.okta.com

    Okta

  • www.okta.com (static site)

    Okta

  • Anything not explicitly called out above as in-scope

    Okta

  • Auth0 passport-ws-fed

    Self-hosted

  • Backend Okta non-app infrastructure

    Okta

  • https://github.com/auth0/passport-wsfed-saml2

    Auth0 by Okta

  • Network layer issues

    Okta

Recent changes

Reward and scope changes across every Okta program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Okta products, from the NVD.

Search NVD
  • CVE-2026-78631 Medium

    The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file.

  • CVE-2026-78629 Medium

    The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.

  • CVE-2026-78630 Medium

    The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An authenticated local user with access to the management interface can supply crafted values, resulting in the execution of arbitrary OS commands with root privileges.

  • CVE-2026-78627 High

    The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the workstation.

  • CVE-2026-78625 Medium

    The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process.

  • CVE-2026-78626 High

    The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources.

  • CVE-2026-78623 High

    The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database.

  • CVE-2026-78579 Medium

    The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of the intended query logic.

About this page

This page gathers every public program listed under okta.com and the companies Okta owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Okta.

Something wrong or missing? Report a correction.