Deutsche Telekom AG bug bounty programs
telekom.com Updated
Deutsche Telekom AG runs one public program: a self-hosted bug bounty paying up to €10,000. It also owns t-mobile.com, which runs one more program.
- Top reward
- $133,700
- t-mobile.com, Bugcrowd
- Programs
- 2
- 2 pay cash
- Targets in scope
- 86
- 8 types, deduplicated
- Last change
- 12 Nov 2026
- 6 hours ago
Where to report
The one public program Deutsche Telekom AG runs itself.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
Telekom
Self-hosted · Bug bounty |
€10,000 | Partial | – | – | Open |
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Deutsche Telekom AG owns
1 company with 1 program of its own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
86 targets across all 2 programs, each listed once with the programs that cover it. 13 excluded.
-
https://play.google.com/store/apps/details?id=com.tmobile.tuesdays&hl=en_US&gl=US
Android
Covered by Bugcrowd
No target matches. Try part of a host name, such as the company name.
Out of scope 13
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
/self-service-*
Bugcrowd
-
https://*.moengage.com
Bugcrowd
-
*.lila.dih.telekom.com
Self-hosted
-
*.mobile.uscc.com
Bugcrowd
-
*.mobile.uscc.net
Bugcrowd
-
*.reverse.open-telekom-cloud.com
Self-hosted
-
*.sprint.net
Bugcrowd
-
https://appointments.uscellular.com
Bugcrowd
-
http://10.62.252.214/flag.txt
Bugcrowd
-
http://10.72.218.66/flag.txt
Bugcrowd
-
All customer systems not owned by Deutsche Telekom AG
Self-hosted
-
Any domain, property, product, protocol, or service of the app/hardware/software version not explicitly listed in the In-Scope section is out of scope; submissions are welcome but not guaranteed for the bounty/bonus.
Bugcrowd
-
PHP RCE vulnerabilities, such as CVE-2026-109618 or CVE-2026-109619
Self-hosted
Recent changes
Reward and scope changes across every Deutsche Telekom AG program, newest first.
-
Raised Self-hosted
Top reward now listed: €10,000.
Recent CVEs
Published vulnerabilities in Deutsche Telekom AG products, from the NVD.
-
CVE-2025-69614 Critical
Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account takeover. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-27, fixed 2025-10-31.
-
CVE-2025-69615 Critical
Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-24, fixed 2025-11-03.
-
CVE-2019-9486 High
STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. An attacker can inject and execute code by hijacking the insecure communications with the service. This vulnerability also aff
About this page
This page gathers every public program listed under telekom.com and the companies Deutsche Telekom AG owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Deutsche Telekom AG.
Something wrong or missing? Report a correction.