- Top reward
- €10,000
- Top severity paid
- Not published
- Assets in scope
- 13
- Public CVEs
- 3
- Last change
At a glance
What to know before you start testing.
- Pays up to €10,000
- top reward, from €2,000.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The old policy link stopped working, so we followed the company's security.txt to the current policy.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
€10,000
10,000 euros │ High / P2
- Lowest reward
-
€2,000
2,000 euros │ Medium / P3
- Safe harbor
-
Partial
We require responsible disclosure. If you discover a vulnerability, please report it to us promptly.
- Hall of fame
-
Yes
Hall of Fame We thank everyone who helps make our services and products safer and better.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 4 excluded.
Domains 7
- auth.otc.t-systems.com
- open-telekom-cloud.com
- otc-service.com
- telekom.com
- telekom.de
- telekom.net
- t-systems.com
Wildcard domains 6
- *.open-telekom-cloud.com
- *.otc-service.com
- *.telekom.com
- *.telekom.de
- *.telekom.net
- *.t-systems.com
Out of scope (4)
- All customer systems not owned by Deutsche Telekom AG
- PHP RCE vulnerabilities, such as CVE-2026-109618 or CVE-2026-109619
- *.lila.dih.telekom.com
- *.reverse.open-telekom-cloud.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Telekom's policy. "We" in these lines means the program, not this site.
While testing
-
Keep vulnerability details confidential
-
Do not test systems outside the scope
-
Publish vulnerabilities only after we have explicitly approved it
-
Do not limit system availability
-
Test only systems within the program scope
-
Do not access data. Do not modify, upload, delete, or share data.
-
Do not conduct social engineering attacks
-
Do not attempt to gain physical access to Deutsche Telekom AG infrastructure or data centers
-
Do not violate applicable law
-
Do not attack third-party systems
Not accepted
-
vulnerabilities in customer systems, third-party software, and services
-
PHP RCE vulnerabilities, such as CVE-2026-109618 or CVE-2026-109619
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
-
Raised
Top reward now listed: €10,000.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2025-69614 | Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account takeover. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-27, fixed 2025-10-31. | Critical 9.4 | 10 Mar 2026 |
| CVE-2025-69615 | Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-24, fixed 2025-11-03. | Critical 9.1 | 10 Mar 2026 |
| CVE-2019-9486 | STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. An attacker can inject and execute code by hijacking the insecure communications with the service. This vulnerability also aff | High 8.8 | 30 Apr 2019 |