Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Expedia Group Bug Bounty

Bug bounty on HackerOne expediagroup.com

Paused
Go to program Website
Top reward
$20,000
Top severity paid
Critical
Assets in scope
77
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $20,000
for critical bugs.
Report on HackerOne
Submit through the program page.

Rewards

What HackerOne lists as the payout for each severity.

Severity Reward
Critical $20,000 from $15,000
High $10,000 from $7,500
Medium $3,500 from $2,500
Low $1,500 from $1,000
Earlier reward tables (1)
  • 12 Nov 2026 to 12 Nov 2026: Critical up to $20,000

Scope

77 assets you may test, 3 excluded.

Wildcard domains 27

  • *.abritel.fr No bounty
  • *.bookabach.co.nz No bounty
  • *.carrentals.com No bounty
  • *.cheaptickets.com No bounty
  • *.ean.com No bounty
  • *.expedia-aarp.com No bounty
  • *.expedia.biz No bounty
  • *.expedia.com No bounty
  • *.expediagroup.com No bounty
  • *.expediapartnercentral.com No bounty
  • *.expediapartnersolutions.com No bounty
  • *.expediataap.com No bounty
  • *.expediataaprewards.com No bounty
  • *.fewo-direkt.de No bounty
  • *.flights.com No bounty
  • *.hotels.com No bounty
  • *.hotwire.com No bounty
  • *.hotwirepartnercentral.com No bounty
  • *.lastminute.com.au No bounty
  • *.lastminute.co.nz No bounty
  • *.orbitz.com No bounty
  • *.stayz.com.au No bounty
  • *.tiqets.com No bounty
  • *.travelocity.ca No bounty
  • *.travelocity.com No bounty
  • *.vrbo.com No bounty
  • *.wotif.com No bounty

Web 24

  • www.abritel.fr Critical
  • www.bookabach.co.nz Critical
  • www.carrentals.com Critical
  • www.cheaptickets.com Critical
  • www.ebookers.com Critical
  • www.ebookers.fi Critical
  • www.expedia-aarp.com Critical
  • www.expedia.com Critical
  • www.expediagroup.com Critical
  • www.expediapartnercentral.com Critical
  • www.expediataap.com High
  • www.fewo-direkt.de Critical
  • www.hotels.com Critical
  • www.hotwire.com Critical
  • www.lastminute.com.au Critical
  • www.lastminute.co.nz Critical
  • www.mrjet.se Critical
  • www.orbitz.com Critical
  • www.stayz.com.au Critical
  • www.tiqets.com Critical
  • www.travelocity.ca Critical
  • www.travelocity.com Critical
  • www.vrbo.com Critical
  • www.wotif.com Critical

Android apps 13

  • com.carrentals No bounty
  • com.cheaptickets No bounty
  • com.ebookers No bounty
  • com.expedia.bookings No bounty
  • com.expediapartnercentral No bounty
  • com.hcom.android No bounty
  • com.homeaway.android No bounty
  • com.hotwire.hotels No bounty
  • com.orbitz No bounty
  • com.travelocity.android No bounty
  • com.vrbo.android No bounty
  • com.wotif.android No bounty
  • https://play.google.com/store/apps/datasafety?id=com.expediapartnercentral&hl=en No bounty

iOS apps 13

  • 1245772818 Critical
  • 284803487 Critical
  • 284971959 Critical
  • 403546234 Critical
  • 427916203 Critical
  • 483394780 Critical
  • 506426310 Critical
  • 531549799 Critical
  • 566635048 Critical
  • 642441300 Critical
  • 880759727 Critical
  • 987675995 Critical No bounty
  • https://apps.apple.com/in/app/expedia-group-partner-central/id987675995 No bounty
Out of scope (3)
  • www.expediacruises.com
  • *.expediaagents.com
  • *.expediacruises.com

Changes

Tracked since 12 Nov 2026. Last checked 1 hour ago.

  1. Paused

    Paused. Not accepting reports right now.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Status

    Program status changed

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.