Corebridge Financial
By Corebridge Financial, Inc. Vulnerability disclosure program on HackerOne corebridgefinancial.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 21
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
21 assets you may test.
Web 18
- corebridgefinancial.com Critical No bounty
- https://agentportal.live.web.corebridgefinancial.com/im/ssagent/public/login#/ Critical No bounty
- https://consultant.live.web.corebridgefinancial.com/valic/consultantdirect/public/login#/ Critical No bounty
- https://diy.corebridgedirect.com/term/home Critical No bounty
- https://ica.live.web.corebridgefinancial.com/distribution/ica/public/login#/ Critical No bounty
- https://live.fo.annuities.crbgf.net Critical No bounty
- https://myaccount.valic.com/auth/public/login#/ Critical No bounty
- https://myaccount.valic.com/enroll/public/get-started Critical No bounty
- https://myplan.myretirementmanager.com/participant/public/login#/ Critical No bounty
- https://optout.life2.corebridgefinancial.com/optout/login.jsp Critical No bounty
- https://portal.annuities.corebridgefinancial.com/annuities/book-of-business/public/login#/ Critical No bounty
- https://rsenablers.live.web.corebridgefinancial.com/valic/nonparticipant/auth/public/login?appname=pso#/ Critical No bounty
- https://tools.valic.com/agilenet5 Critical No bounty
- https://www.corebridgefinancial.com/rs/dropsolutions Critical No bounty
- http://www.myretirementmanager.com Critical No bounty
- rapid-rater.live.web.corebridgefinancial.com Critical No bounty
- www.connext.corebridgefinancial.com Critical No bounty
- www.corebridgedirect.com Critical No bounty
Wildcard domains 2
- *.corebridgefinancial.com Critical No bounty
- *.valic.com Critical No bounty
Products and areas 1
- modeldsu-idp.dsu.corebridgefinancial.com Critical No bounty
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Corebridge Financial (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Please include a header X-Hackerone: <h1_username> when you test so we can identify your requests.
-
You agree not to disclose vulnerability details to anyone other than Corebridge Financial or HackerOne without Corebridge Financial written permission.
-
You will not attempt to gain access to customer or user accounts or confidential information and will only interact with accounts you own
-
If you unintentionally access a customer or user account that you, disconnect from the account, let Corebridge and HackerOne know immediately, and document your discovery.
-
Common Automated Tooling including but not limited to Acunetix, Nessus, and Qualys should be avoided; however, use of Burp Suite and other custom tools are allowed
-
Avoid privacy violations, destruction of data, and interruption or degradation of our services
-
Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
-
Provide details with reproducible steps in your report.
-
Comply with applicable federal, state, local, and international laws in connection with your participation in this vulnerability disclosure program.
Not accepted
-
Clickjacking on pages with no sensitive actions
-
Unauthenticated/logout/login CSRF
-
Insecure Cookie Settings on non-sensitive cookies
-
Bugs requiring inordinate amounts of user interaction or prior knowledge of user secrets such as session tokens or CSRF values
-
Information regarding software versions or web server versions/banners where there is no evidence these versions are impacted by a security flaw
-
Attacks requiring MITM or physical access to a user's device
-
Previously known vulnerable libraries without a working Proof of Concept
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability
-
Any activity that could lead to the disruption of our service (DoS)
-
Content spoofing and text injection issues without showing an attack vector or without being able to modify HTML/CSS
-
Overly Permissive Google Maps API keys
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited
-
Missing SPF records
-
Do not test the physical security of Corebridge Financial property
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 18 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
https://portal.annuities.corebridgefinancial.com/annuities/book-of-business/public/login#/
-
Scope added
https://rsenablers.live.web.corebridgefinancial.com/valic/nonparticipant/auth/public/login?appname=pso#/
-
Scope added
https://agentportal.live.web.corebridgefinancial.com/im/ssagent/public/login#/
-
Scope added
https://consultant.live.web.corebridgefinancial.com/valic/consultantdirect/public/login#/
-
Scope added
https://ica.live.web.corebridgefinancial.com/distribution/ica/public/login#/
-
Scope added
https://myaccount.valic.com/auth/public/login#/
-
Scope added
https://myplan.myretirementmanager.com/participant/public/login#/
-
Scope added
https://optout.life2.corebridgefinancial.com/optout/login.jsp
-
Scope added
https://www.corebridgefinancial.com/rs/dropsolutions
-
Scope added
modeldsu-idp.dsu.corebridgefinancial.com
-
Scope added
rapid-rater.live.web.corebridgefinancial.com
-
Scope added
www.connext.corebridgefinancial.com
-
Scope added
www.corebridgedirect.com
-
Scope added
www.myretirementmanager.com
-
Scope added
https://ca-optout.live.web.corebridgefinancial.com/optout/login.jsp
-
Scope added
*.corebridgefinancial.com
-
Scope added
*.valic.com
-
Scope added
corebridgefinancial.com
-
Scope added
https://diy.corebridgedirect.com/term/home
-
Scope added
https://live.fo.annuities.crbgf.net/
-
Scope added
https://tools.valic.com/agilenet5
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Vulnerability Disclosure Program (VDP)
Corebridge Financial is proactively advancing our security to identify new threats and help ensure the safety of customer accounts and information.
We value the important role the security community plays in helping us mitigate information security risk, therefore we leverage the security community and value the researchers' time to bring these issues to our attention.
If you have information about possible security vulnerabilities in any Corebridge Financial product or service, please submit a report using these guidelines.
Guidelines
- Your report must meet all HackerOne’s Vulnerability Disclosure Guidelines.
- When reporting vulnerabilities, consider (1) the attack scenario or exploitability, and (2) the security impact of the bug.
- Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
- Provide details with reproducible steps in your report.
- Comply with applicable federal, state, local, and international laws in connection with your participation in this vulnerability disclosure program.
- We may modify the terms of this policy or terminate the policy at any time.
By Submitting a Report:
- You agree not to disclose vulnerability details to anyone other than Corebridge Financial or HackerOne without Corebridge Financial written permission.
- You represent you are not located in or a resident of a country under United States sanctions, nor a person on, or working on behalf of a party identified on, any restricted party list maintained by the United States government.
- You consent to your information being stored and transferred to the United States and acknowledge you have read and accepted the terms of this policy and HackerOne’s Vulnerability Disclosure Guidelines.
- You agree that any Corebridge Financial information that you may encounter, view, acquire, or access, is owned by Corebridge Financial or its customers, clients, or third-party providers. You have no rights, title, or ownership in any such information.
- You agree that your research will be conducted for testing and research purposes only, and that you will not attempt to gain access to customer or user accounts or confidential information and will only interact with accounts you own;
- You agree that if you unintentionally access a customer or user account that you, disconnect from the account, let Corebridge and HackerOne know immediately, and document your discovery.
- You understand that nothing in this agreement, including submission of a report, shall be deemed to constitute the grant to you of any license or other right to or in respect of any Corebridge Financial or third-party product, service, patent, trademark, trade secret, or other intellectual property.
- You hereby grant Corebridge Financial a perpetual, worldwide, exclusive, fully-paid-up license to sublicense, copy, distribute, display, perform, transmit, and publish the report.
Creating Accounts for Vulnerability Research
- Please include a header X-Hackerone: <h1_username> when you test so we can identify your requests. You can create match and replace the proxy rule in Burp by going to Proxy >> Options >> Match and Replace with the following options:
Type: Request header
Match: ^User-Agent.*$
Replace: `User-Agent: corebridgevdpresearcheryourh1username`
Scope
Domains where Corebridge Financial are listed as the Registrant Organization, Admin Organization, or Tech Organization are in scope. Domains maintained by third parties, other than Corebridge Financial, are not in scope for this program. Not sure what’s in scope? Send an email to [email protected]. Registrant Info
Registrant Name: Domain Administrator Registrant Organization: Corebridge Financial, Inc. Registrant Street: 2919 Allen Parkway, Woodson Tower Registrant City: Houston Registrant State/Province: TX Registrant Postal Code: 77019 Registrant Country: US Registrant Phone: +1.8773752422 Registrant Phone Ext: Registrant Fax: +1.8773752422 Registrant Fax Ext: Registrant Email: [email protected]
Vulnerabilities typically in scope include items from the OWASP Top 10 and vulnerabilities with a confirmed security impact.
We reserve the right to determine whether to accept a report. For example, we may not accept:
- A report of a vulnerability resulting from a violation of the program guidelines
- A report on a vulnerability with little security impact or exploitability
- A vulnerability discoverable through automated scans that have not been verified manually
Certain vulnerabilities are considered out of scope for our Vulnerability Disclosure Program. These include:
- Clickjacking on pages with no sensitive actions
- Unauthenticated/logout/login CSRF
- Insecure Cookie Settings on non-sensitive cookies
- Bugs requiring inordinate amounts of user interaction or prior knowledge of user secrets such as session tokens or CSRF values
- Information regarding software versions or web server versions/banners where there is no evidence these versions are impacted by a security flaw
- Attacks requiring MITM or physical access to a user's device
- Previously known vulnerable libraries without a working Proof of Concept
- Comma Separated Values (CSV) injection without demonstrating a vulnerability
- Common Automated Tooling including but not limited to Acunetix, Nessus, and Qualys should be avoided; however, use of Burp Suite and other custom tools are allowed
- Any activity that could lead to the disruption of our service (DoS)
- Content spoofing and text injection issues without showing an attack vector or without being able to modify HTML/CSS
- Overly Permissive Google Maps API keys
- Avoid privacy violations, destruction of data, and interruption or degradation of our services
- Social engineering (e.g. phishing, vishing, smishing) is prohibited *Missing SPF records.
- Do not test the physical security of Corebridge Financial property
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Thank you for assisting Corebridge Financial!