NiceHash Mining platform
Bug bounty on HackenProof nicehash.com
Accepting reports
Infrastructure
Web
apps
- Top reward
- $25,000
- Top severity paid
- Critical
- Assets in scope
- 4
- Public CVEs
- 4
- Last change
At a glance
What to know before you start testing.
- Pays up to $25,000
- for critical bugs.
- Report on HackenProof
- Submit through the program page.
Rewards
What HackenProof lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$25,000 |
Scope
4 assets you may test, 3 excluded.
Android apps 1
- https://play.google.com/store/apps/details?id=com.nicehash.metallum&hl=en
APIs 1
- https://api-test.nicehash.com
Domains 1
- test.nicehash.com
iOS apps 1
- https://apps.apple.com/si/app/nicehash/id1372054956
Out of scope (3)
- https://github.com/nicehash/NHOS
- https://github.com/nicehash/NiceHashMiner
- https://github.com/nicehash/NiceHashQuickMiner
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope removed
https://github.com/nicehash/NHOS
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2025-56513 | NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An attacker capable of intercepting or redirecting traffic to the update url and can hijack the update process and deliver arbitrary executables that are automatically executed, resulting in full remote code execution. This constitutes a critical supply chain attack vector. NOTE: the | Critical 9.8 | 30 Sep 2025 |
| CVE-2019-6120 | An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 (Username Enumeration) an adversary can enumerate a large number of valid users' Email addresses. | High 7.5 | 6 Nov 2019 |
| CVE-2019-6121 | An issue was discovered in NiceHash Miner before 2.0.3.0. Missing Authorization allows an adversary to can gain access to a miner's information about such as his recent payments, unclaimed Balance, Old Balance (at the time of December 2017 breach) , Projected payout, Mining stats like profitability, Efficiency, Number of workers, etc.. A valid Email address is required in order to retrieve this In | Low 3.7 | 6 Nov 2019 |
| CVE-2019-6122 | A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address. | Low 3.1 | 6 Nov 2019 |