- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://openlitespeed.org
Products and areas 12
- Access and error logging, and how attacker-controlled request data reaches a log line
- LSAPI, CGI, FastCGI and proxy handlers, and every path where request data reaches an external process
- PHP process management, covering how lsphp workers are spawned, reused between requests and torn down
- Static file serving, path resolution, rewrite rules and the .htaccess compatibility layer
- The cache module and its key derivation, since a keying defect serves one visitor's response to another
- The configuration parser and the virtual-host model, including how one tenant's configuration is kept out of another's reach on a shared server
- The control interface, the signal handling and the files used to reload or restart a running server
- The core HTTP engine across HTTP/1.1, HTTP/2 and HTTP/3, covering request parsing, header handling, framing and connection reuse
- The reverse proxy path to backend servers and the trust it places in a backend response
- The vendor's security page states its scope as LiteSpeed Web Server, LiteSpeed Web ADC, OpenLiteSpeed and others, so the whole product is accepted rather than a named list of components
- The WebAdmin console in full: authentication, session handling, every configuration form and every action it can invoke on the host
- TLS termination, certificate handling and SNI-based virtual host selection
Out of scope (6)
- Configurations that expose WebAdmin to the internet on default credentials, an operator decision rather than a server defect
- Denial of service proportional to request volume with no amplification factor
- Findings that apply only to the commercial builds with no effect on the open source product, though the vendor accepts reports on both
- LiteSpeed Cache for WordPress, a separate product run by a different team with its own reward ecosystem
- PHP itself and other backends reached over LSAPI, CGI or FastCGI
- Third-party control panels that generate OpenLiteSpeed configuration
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Report through the vendor form at litespeedtech.com/report-security-bugs.
-
Say whether the finding applies to OpenLiteSpeed only or also to the commercial LiteSpeed Web Server.
-
For anything in the admin console, state the exact authentication state you were in and how you reached it
-
Include the server configuration that reproduces it.
-
agree a disclosure date with the vendor in writing before you start a clock
Not accepted
-
LiteSpeed Cache for WordPress, a separate product run by a different team with its own reward ecosystem
-
PHP itself and other backends reached over LSAPI, CGI or FastCGI
-
Configurations that expose WebAdmin to the internet on default credentials, an operator decision rather than a server defect
-
Third-party control panels that generate OpenLiteSpeed configuration
-
Denial of service proportional to request volume with no amplification factor
-
Findings that apply only to the commercial builds with no effect on the open source product
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview OpenLiteSpeed is the open source edition of LiteSpeed Web Server, and the LiteSpeed family serves 15.1 percent of all websites with a known web server. W3Techs does not separate the open source build from the commercial one, so read that share as the family's. CVE-2026-31386 is the reference point: OS command injection in the admin functionality, reaching remote code execution on the host that serves every site on it. LiteSpeed Technologies states plainly that it runs no official bug bounty programme and that any compensation is at its own discretion. sorona.xyz pays you directly on qualified, reproduced findings. In scope The vendor's security page states its scope as LiteSpeed Web Server, LiteSpeed Web ADC, OpenLiteSpeed and others, so the whole product is accepted rather than a named list of components The core HTTP engine across HTTP/1.1, HTTP/2 and HTTP/3, covering request parsing, header handling, framing and connection reuse The WebAdmin console in full: authentication, session handling, every configuration form and every action it can invoke on the host The configuration parser and the virtual-host model, including how one tenant's configuration is kept out of another's reach on a shared server LSAPI, CGI, FastCGI and proxy handlers, and every path where request data reaches an external process PHP process management, covering how lsphp workers are spawned, reused between requests and torn down Static file serving, path resolution, rewrite rules and the .htaccess compatibility layer TLS termination, certificate handling and SNI-based virtual host selection The cache module and its key derivation, since a keying defect serves one visitor's response to another The reverse proxy path to backend servers and the trust it places in a backend response The control interface, the signal handling and the files used to reload or restart a running server Access and error logging, and how attacker-controlled request data reaches a log line Out of scope LiteSpeed Cache for WordPress, a separate product run by a different team with its own reward ecosystem PHP itself and other backends reached over LSAPI, CGI or FastCGI Configurations that expose WebAdmin to the internet on default credentials, an operator decision rather than a server defect Third-party control panels that generate OpenLiteSpeed configuration Denial of service proportional to request volume with no amplification factor Findings that apply only to the commercial builds with no effect on the open source product, though the vendor accepts reports on both Most-valued findings Command injection through the WebAdmin console. Every recent public finding here has been in that class, including CVE-2026-31386, and it is the first place to look Authentication or authorisation bypass on WebAdmin, since the console can rewrite the server's configuration and execute commands on the host Anything that crosses a virtual-host boundary, because the deployments that matter here are shared hosting and one tenant reaching another's document root is the worst case Request smuggling or desync between the core server and an LSAPI or FastCGI backend, where the backend trusts headers the front end was supposed to control Cache poisoning through key handling or variant selection, given that the cache is the product's headline feature and a poisoned entry is served to everyone Path resolution and rewrite defects producing traversal or source disclosure of application files Memory safety in the C++ request path reachable before authentication, which on a server written in C++ is a pre-auth primitive rather than a crash Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through the vendor form at litespeedtech.com/report-security-bugs. That page names OpenLiteSpeed in its scope alongside LiteSpeed Web Server and Web ADC GitHub private vulnerability reporting is also enabled on litespeedtech/openlitespeed , though the repository carries no SECURITY.md and has never published an advisory The vendor rules out an official bounty and says any financial compensation is at its discretion alone. Plan the work as unpaid and do not build a report around an expected payment Say whether the finding applies to OpenLiteSpeed only or also to the commercial LiteSpeed Web Server. They share lineage, the vendor handles both, and the answer decides how the fix ships For anything in the admin console, state the exact authentication state you were in and how you reached it, since privilege boundary is the whole question in that component Include the server configuration that reproduces it. Behaviour here is configuration-driven and a bare request rarely reproduces on a default install The LiteSpeed Cache plugin for WordPress is a different product run by a different team. The large bounties in that ecosystem do not reach this one Disclosure Handled by LiteSpeed Technologies through its own reporting form rather than by a community process. The repository publishes no advisories, so the visible artefact is usually a release note plus a CVE assigned by a third party, and recent findings here have surfaced through outside research teams rather than through the project. Plan for less transparency than the GitHub-native projects in this category, and agree a disclosure date with the vendor in writing before you start a clock. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability