- Top reward
- $10,000
- Top severity paid
- Critical
- Assets in scope
- 25
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $10,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$10,000 |
| High |
|
$4,000 |
| Medium |
|
$1,000 |
| Low |
|
$400 |
- Safe harbor
-
Partial
Research conducted in violation of this section is not a good faith effort to comply with our guidelines, and violations may result in forfeiture of bounty eligibility and removal from the program.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
25 assets you may test.
Web 22
- app.livenation.com Critical
- app.ticketmaster.ca Critical
- app.ticketmaster.com Critical
- app.ticketmaster.com.au Critical
- app.ticketmaster.com.mx Critical
- app.ticketmaster.co.uk Critical
- app.ticketmaster.eu Critical
- app.ticketmaster.ie Critical
- frontgatetickets.com Critical
- https://signup.ticketmaster.com/bugbountytest Critical
- livenation.com Critical
- livenation.me Critical
- ticketmaster.ca Critical
- ticketmaster.com Critical
- ticketmaster.com.br Critical
- ticketmaster.com.mx Critical
- ticketmaster.co.uk Critical
- ticketmaster.de Critical
- www.lineup.com.mx Critical
- www.livenation.co.uk Critical
- www.onthewaterfrontfestival.com Critical
- www.royalarena.dk Critical
iOS apps 2
- https://apps.apple.com/no/app/royal-arena/id1181913144 Critical
- https://apps.apple.com/us/app/ticketmaster-buy-sell-tickets/id500003565 Critical
Android apps 1
- dk.royalarena.app Critical
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Live Nation (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Use your HackerOne email alias ([email protected]) and comply with the applicable terms of use when creating accounts on Live Nation Entertainment public properties.
-
Identify your traffic by sending an HTTP header on all testing traffic: `X-HackerOne-Research: <H1 username>`.
-
Use bots, automated scanning tools, LLMs, or generative AI in the discovery of bugs. We only accept bugs found by humans.
-
Test or interact with any accounts belonging to people other than you.
-
Test unlisted sites, hostnames, or domains. Assets not explicitly listed are out of scope; do not test them.
-
Send us excessive traffic or conduct Denial of Service testing.
-
Access, or attempt to access, internal systems, administrative endpoints, or data belonging to anyone else. If you discover an exposed internal system, stop and report it. Do not explore further.
-
Publicly disclose your findings, which is strictly prohibited.
Not accepted
-
Cross-site scripting (XSS).
-
Missing or misconfigured security headers without proof of impact.
-
Bugs requiring unrealistic user interaction.
-
Denial of Service.
-
Social engineering, including phishing, vishing, smishing, and quishing.
-
Physical security testing.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 19 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Status
Program status changed
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
HackerOne Program Policy – Proposed Public Launch Policy
PROGRAM RULES
Must
- Provide detailed, reproducible reports. Insufficient information may result in rejection of your report.
- Submit one bug per report unless chaining is required for impact.
- Use your HackerOne email alias ([email protected]) and comply with the applicable terms of use when creating accounts on Live Nation Entertainment public properties.
- Identify your traffic by sending an HTTP header on all testing traffic:
X-HackerOne-Research: <H1 username>.
Must Not
- Use bots, automated scanning tools, LLMs, or generative AI in the discovery of bugs. We only accept bugs found by humans.
- Test or interact with any accounts belonging to people other than you.
- Test unlisted sites, hostnames, or domains. Assets not explicitly listed are out of scope; do not test them.
- Send us excessive traffic or conduct Denial of Service testing.
- Access, or attempt to access, internal systems, administrative endpoints, or data belonging to anyone else. If you discover an exposed internal system, stop and report it. Do not explore further.
- Publicly disclose your findings, which is strictly prohibited.
SUBMISSION REQUIREMENTS
To be considered valid, reports must:
- Include clear reproduction steps and proof of impact.
- Have been submitted privately and responsibly.
- Test only accounts and data owned by the submitter.
- Be the first fully reproducible report that we receive. We do not honor duplicate submissions.
- Avoid data destruction, service disruption, or privacy violations.
- Access only the minimum data necessary to prove a vulnerability exists and demonstrate impact. Do not download, store, or retain additional data, including the personal information of our fans and employees.
- Demonstrate realistic security impact.
- Before submitting, redact any and all sensitive data including but not limited to PII, credit card data, usernames, passwords, etc.
- Do NOT name specific artists, event names, or team names in reports.
REWARDS
Live Nation Entertainment offers monetary bounties for valid, in-scope reports. Awards are based on severity and demonstrated impact, per the ranges in the In-Scope Asset Table. Duplicate, out-of-scope, and ineligible findings are not rewarded.
ASSET SCOPE
In Scope Assets
See the In-Scope Asset Table.
Out of Scope Assets
- Third-party platforms or services not owned or operated by Live Nation Entertainment.
- Internal systems, corporate tools, VPNs, or employee-facing infrastructure.
- Development, staging, QA, or test environments unless explicitly listed.
- Deprecated or retired applications and domains.
- Assets not explicitly listed are out of scope by default.
CONFIDENTIALITY
This program does not permit public disclosure of any kind. All vulnerabilities, findings, report contents, and communications must remain strictly confidential and may not be published, shared, or discussed with any third party without our prior written consent, including after remediation or report closure. Compliance with this policy is a condition of participation in this program. Research conducted in violation of this section is not a good faith effort to comply with our guidelines, and violations may result in forfeiture of bounty eligibility and removal from the program.
BUG SCOPE
In Scope Bugs
Authentication and Authorization
- Account takeover.
- Privilege escalation.
- Insecure direct object reference (IDOR).
- Authentication, MFA, and OTP bypass.
- Identity Verification (IDV) bypass.
Injection and Execution
- SQL and NoSQL injection.
- Command injection.
- Remote code execution (RCE).
- Server-side template injection (SSTI).
Web and API
- Cross-site request forgery (CSRF) with a demonstrable, real-world security impact.
- Server-side request forgery (SSRF).
- DNS subdomain takeover.
- Insecure deserialization.
Data Exposure
- Unauthorized access to sensitive data, including personal information and payment data.
- Hard-coded or exposed secrets with demonstrated exploitability.
Business Logic
- SafeTix 2.0: See the SafeTix 2.0 section below.
- Onsale queue exploitation: reaching the front of the queue without waiting.
- Ticket transfer bypass: transferring tickets without MFA.
Out of Scope Bugs
HackerOne Core Ineligible Bugs are out of scope. In addition:
- Cross-site scripting (XSS).
- Missing or misconfigured security headers without proof of impact.
- Bugs requiring unrealistic user interaction.
- Denial of Service.
- Social engineering, including phishing, vishing, smishing, and quishing.
- Physical security testing.
SAFETIX 2.0
We welcome security testing of SafeTix 2.0, the technology that keeps a digital ticket on a fan's mobile device and prevents it from being transferred outside the Ticketmaster chain of custody.
In scope for bounty: bugs that allow tickets to be transferred to another account without MFA or OTP, allow a ticket barcode to be rendered off the fan device, or allow the creation of new tickets.
NOTE: There are instances where low risk accounts that are over 90 days old will allow for ticket transfers to other low risk accounts which are also over 90 days old. This is expected behavior.
SafeTix Testing, Rules of Engagement
1. Objective
Test whether SafeTix 2.0 prevents the creation of tickets outside the Ticketmaster chain of custody, or the use of scannable tickets to gain entry to an event. In-scope bugs include reproduction, duplication, replay, or bypass of device-bound ticket rendering and scanning technology.
2. Definition of a SafeTix Bypass
A bug qualifies as a bypass if any of the following occur without an authorized transfer within the Ticketmaster ecosystem:
- A ticket rendered and successfully scanned on an unbound or unauthorized device outside a Ticketmaster account.
- A ticket duplicated so that multiple devices scan successfully outside the chain of custody.
- A ticket made scannable after violating device limits, untrusted device enforcement, or partner restrictions.
- A ticket made scannable via legacy or fallback paths (wallet, web, compatibility mode).
3. Authorized Scope
- Use only the test tickets provided on request.
- Testing is permitted across device types (iOS and Android), OS versions, and network conditions (Wi-Fi, cellular, offline).
- Rooted or jailbroken device testing is permitted.
- Testing may include attempts to replay, capture, duplicate, or externally reproduce visible barcodes for the test events.
- Testing must be done on the most current version of the mobile app for iOS and Android.
4. Evidence and Reporting Requirements
Each submission must include:
- Device model and OS version; app version and SDK version if visible.
- Account state, network condition, which event was tested, and scanner mode (online or offline).
- Clear high-level reproduction steps, screenshots or video evidence with timestamps.
- A severity classification: Critical (unauthorized device scans), High (scannable artifact produced outside custody), Medium (bypass under unlikely conditions), Low (UX, logging, or messaging).
PERSONA & ARTIST SIGN-UP VERIFICATION TESTING
We are launching a focused testing campaign inviting our security researcher community to evaluate the identity verification controls on our Artist Sign-Up (ASU) flow.
1. Objective
We are interested in reports which demonstrate that verification steps in this flow are bypassed.
2. Definition of a Verification Bypass
A bug qualifies as a bypass whenever MFA/OTP can be circumvented to and/or from high-risk accounts.
What to Focus On
This campaign accepts submissions for the following two areas only:
- Bypassing Persona identity verification during the sign-up process.
- Bypassing the ASU (Artist Sign-Up) screen itself.
For this test event, verification prompting has been configured so that every sign-up attempt should trigger a Persona identity check. If you are able to complete a sign-up, reach a post-verification state, or otherwise progress through the flow without a valid Persona verification having occurred, that is a reportable finding.
3. Authorized Scope
URL: https://signup.ticketmaster.com/bugbountytest
This is a dedicated test event set up specifically for this campaign. It is live on our production infrastructure but isolated so that testing against it does not cause any operational impact. Please limit your testing activity to this URL only. Testing against any other live event or production sign-up flow is out of scope and outside the terms of our bug bounty program.
- Testing is permitted across device types (iOS and Android), OS versions, and network conditions (Wi-Fi, cellular, offline).
- Rooted or jailbroken device testing is permitted.
4. Evidence and Reporting Requirements
Each submission must include:
- Browser name and version.
- Account state, network condition, which event was tested, and scanner mode (online or offline).
- Clear high-level reproduction steps, screenshots, or video evidence with timestamps.
- A severity classification: Critical (unauthorized device scans), High (scannable artifact produced outside custody), Medium (bypass under unlikely conditions), Low (UX, logging, or messaging).
ASU Sign-Up Flow (Test Campaign)
- Landing – User navigates to the test event URL: https://signup.ticketmaster.com/bugbountytest
- Account Creation – User creates a username and password.
- Email Verification – User verifies their email address.
- Phone Verification – User verifies their phone number.
- Redirect – User is redirected to the identity verification step.
- Persona Verification – User is prompted to verify their identity via Persona (photo ID + selfie match).
- Completion – Sign-up is finalized.
Note to Researchers: This is a test event built for this purpose. Please do not test against real artist sign-up campaigns or other live events.
RIGHTS AND LICENSES
Live Nation Entertainment may modify the terms and conditions or terminate the program at any time.