Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Telenor Sweden Public Bug Bounty Program

By Telenor Sverige AB Bug bounty on YesWeHack telenor.se

Accepting reports
Go to program
Top reward
€6,000
Top severity paid
Critical
Assets in scope
25
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to €6,000
for critical bugs, from €50.
Report on YesWeHack
Submit through the program page.
No public write-ups
Keep findings private.

Rewards

What YesWeHack lists as the payout for each severity.

Severity Reward
Critical €6,000
High €2,500
Medium €600
Low €200

Scope

25 assets you may test, 16 excluded.

Wildcard domains 19

  • *.api-app.telenor.se
  • *.apis.telenor.se
  • *.api.vimla.se
  • *.bredbandsbolaget.se
  • *.europolitan.se
  • *.foretagsportalen.telenor.se
  • *.inpli.se
  • *.mittforetag.telenor.se
  • *.mitt.vimla.se
  • *.ownit.se
  • *.play.ownit.se
  • *.profile.telenor.se
  • *.signin.telenor.se
  • *.stream.telenor.se
  • *.telenorinpli.se
  • *.telenor.se
  • *.vimla.io
  • *.vimla.se
  • *.vimla.work

Web 3

  • ownit.se
  • telenor.se
  • vimla.se

iOS apps 2

  • https://apps.apple.com/se/app/vimla/id1233271881
  • https://apps.apple.com/se/app/vimla/id1233271881 https://play.google.com/store/apps/details?id=com.vimlaapp&hl=en

Android apps 1

  • https://play.google.com/store/apps/details?id=com.vimlaapp&hl=en
Out of scope (16)
  • admin-stage.tv.telenor.se
  • Any domain that looks like it's owned by a third party or customer due to customer's privacy
  • butik.vimla.se
  • faq.vimla.se
  • Mobile services and devices provided by Telenor Sweden and subsidiaries not reachable from Internet
  • Other business units of the Telenor Group - including *.telenor.com
  • stage-vimla-se.vimla.io
  • status.vimla.se
  • tc.ownit.se
  • *.bbcust.telenor.se
  • *.cust.bredbandsbolaget.se
  • *.customers.ownit.se
  • *.cust.ownit.se
  • *.cust.telenor.se
  • *.ownit.nu
  • *.sme.telenor.se

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Telenor Sweden Public Bug Bounty Program (via YesWeHack)'s policy. "We" in these lines means the program, not this site.

While testing

  • Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through yeswehack.com
  • You must avoid tests that could cause degradation or interruption of our service. (Please respect this, DoS not in scope)
  • You must not leak, manipulate, or destroy any user data.
  • DO NOT alter compromised accounts by creating, deleting or modifying any data
  • DO NOT use compromised accounts to search for post-auth vulnerabilities (they won’t be eligible anyway)
  • DO NOT include Personally Identifiable Information (PII) in your report and please REDACT/OBFUSCATE the PII
  • In case of exposed credentials or secrets, limit yourself to verifying the credentials validity
  • In case of sensitive information leak, DO NOT extract/copy every document or data that is exposed
  • Uploading files that allow arbitrary commands (i.e. a webshell)
  • Creating and maintaining a persistent connection to the server

Not accepted

  • Any hypothetical flaw or best practices without exploitable PoC
  • Self reflected injections (i.e., html/xss injection that can't impact others)
  • Mixed content warnings
  • Denial of Service (DoS) attacks that cause degradation of services
  • Social engineering of any kind
  • Presence of autocomplete attribute on web forms
  • TLS / SSL
  • Attacks requiring MITM or physical access to victim's device
  • Issues that require unlikely user interaction
  • Low impact or low-severity Cross-Site Request Forgery (CSRF) attacks
  • Invalid or missing SPF (Sender Policy Framework), DKIM, DMARC records
  • HTTP Strict Transport Security Header (HSTS)
  • Subdomain takeover without a full working PoC
  • Blind SSRF without direct impact (e.g. DNS pingback)
  • Lack of rate-limiting, brute-forcing or captcha issues
  • CSV injection
  • Task Hijacking
  • Crashing your own application
  • Generic Android or iOS vulnerabilities
  • Clickjacking/UI redressing on pages

Summarised with AI from the program policy on YesWeHack, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 8 minutes ago.

  1. Scope +

    Added to scope: butik.vimla.se

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    admin-stage.tv.telenor.se (out of scope)

  2. Scope added

    status.vimla.se (out of scope)

  3. Scope removed

    *.telenorcdn.net

  4. Scope removed

    *.tv.telenor.se

  5. Scope added

    stage-vimla-se.vimla.io (out of scope)

  6. Scope added

    faq.vimla.se (out of scope)

  7. Scope added

    tc.ownit.se (out of scope)

  8. Scope added

    *.ownit.nu (out of scope)

  9. Scope added

    *.customers.ownit.se (out of scope)

  10. Scope added

    *.cust.bredbandsbolaget.se (out of scope)

  11. Scope added

    *.sme.telenor.se (out of scope)

  12. Scope added

    *.cust.telenor.se (out of scope)

  13. Scope added

    *.bbcust.telenor.se (out of scope)

  14. Scope added

    *.cust.ownit.se (out of scope)

  15. Scope added

    Other business units of the Telenor Group - including *.telenor.com (out of scope)

  16. Scope added

    Mobile services and devices provided by Telenor Sweden and subsidiaries not reachable from Internet (out of scope)

  17. Scope added

    Any domain that looks like it's owned by a third party or customer due to customer's privacy (out of scope)

  18. Scope added

    *.play.ownit.se

  19. Scope added

    https://apps.apple.com/se/app/vimla/id1233271881 https://play.google.com/store/apps/details?id=com.vimlaapp&hl=en

  20. Scope added

    https://play.google.com/store/apps/details?id=com.vimlaapp&hl=en

  21. Scope added

    vimla.se

  22. Scope added

    *.stream.telenor.se

  23. Scope added

    *.mittforetag.telenor.se

  24. Scope added

    *.foretagsportalen.telenor.se

  25. Scope added

    ownit.se

  26. Scope added

    *.api.vimla.se

  27. Scope added

    *.mitt.vimla.se

  28. Scope added

    *.api-app.telenor.se

  29. Scope added

    *.apis.telenor.se

  30. Scope added

    *.profile.telenor.se

  31. Scope added

    *.signin.telenor.se

  32. Scope added

    telenor.se

  33. Scope added

    *.telenor.se

  34. Scope added

    *.europolitan.se

  35. Scope added

    *.bredbandsbolaget.se

  36. Scope added

    *.telenorinpli.se

  37. Scope added

    *.inpli.se

  38. Scope added

    *.vimla.io

  39. Scope added

    *.vimla.work

  40. Scope added

    *.vimla.se

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from yeswehack.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Rules

At Telenor we recognize the important role that security researchers play in helping to keep Telenor Sverige AB and our customers secure.

By participating in this program you acknowledge that you have read and agreed to these Program Rules.

Scope of this program

We aim to test most of our assets through this program. Nevertheless, we ask you to read carefully the list of exclusions (Out-of-Scope) before starting; some domains are related to Telenor's customers, these should not be tested and will not be eligible for a reward anyway.

Eligibility and Responsible Disclosure

We are happy to thank everyone who submits valid reports which help us improve the security of Telenor Sverige AB, however, only those that meet the following eligibility requirements may receive a monetary reward:

  • You must be the first reporter of a vulnerability.
  • The vulnerability must be a qualifying vulnerability
  • Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through yeswehack.com
  • You must send a clear description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
  • You must avoid tests that could cause degradation or interruption of our service. (Please respect this, DoS not in scope)
  • You must not leak, manipulate, or destroy any user data.
  • You must not be a former or current employee of Telenor or one of its contractor.
  • No vulnerability disclosure, including partial, is allowed. This includes resolved and closed reports.

Required Submission Information

For all submissions, please include a full description of the vulnerability, including exploitability and impact. Also, provide evidence of the issue, such as:

  • Videos
  • Screenshots
  • PoC code
  • Traffic logs
  • Web/API requests and responses
  • Email/user ID of test accounts
  • IP address used during testing
  • For RCE reports, see the RCE Rules section below

Important precautions and limitations

As a complement to the Program’s rules and testing policy :

  • DO NOT alter compromised accounts by creating, deleting or modifying any data
  • DO NOT use compromised accounts to search for post-auth vulnerabilities (they won’t be eligible anyway)
  • DO NOT include Personally Identifiable Information (PII) in your report and please REDACT/OBFUSCATE the PII that is part of your PoC (screenshot, server response, JSON file, etc.) as much as possible.
  • In case of exposed credentials or secrets, limit yourself to verifying the credentials validity
  • In case of sensitive information leak, DO NOT extract/copy every document or data that is exposed and limit yourself to describe and list what is exposed.

Remote Code Execution (RCE) and Cross-Site Scripting (XSS):

RCE Rules

Allowed Actions:

  • Directly injecting benign commands via the web application or interface (e.g. whoami, hostname, ifconfig)
  • Uploading a file that outputs the result of a hard-coded benign command

Prohibited Actions:

  • Uploading files that allow arbitrary commands (i.e. a webshell)
  • Modifying any files or data, including permissions
  • Deleting any files or data
  • Interrupting normal operations (e.g. triggering a reboot)
  • Creating and maintaining a persistent connection to the server
  • Intentionally viewing any files or data beyond what is needed to prove the vulnerability
  • Failing to disclose any actions taken or applicable required information

For reports, please include:

  • Source IP and timestamp (with time zone)
  • Server request and responses
  • Filenames of any uploaded files, which must include “telenor_ywh” and the timestamp
  • Callback IP and port (if applicable)
  • Any data accessed (deliberately or inadvertently)

About XSS

Unless you can demonstrate a specific situation where an XSS becomes a "HIGH" or "CRITICAL" finding, it is likely an XSS vulnerability will score as "MEDIUM".

In this case, and if you want your report to be rewarded as a ‘High’ or ‘Critical’ finding, please provide a realistic, proven and step by step detailed scenario of exploitability, including elements that could be modified through this exploit, or actions that could be undertaken on behalf of targeted user.

For example : XHR request to modify account information and could lead to an account take over.

There is also a certain chance, that similar XSS exploits on different endpoints or parameters are caused by the same underlying input validation weakness. If that is the case, we reserve the right to honor only a single report and to reject the other ones as ‘Duplicate’/’Informative’.

About non production environments

  Non production environments (e.g. uat, qual, pprd, dev, ...) related to our wildcards scopes may be publicly accessible. You're welcome to test them but mind that if the issue can't be reproduced in/don't impact production we'll apply the "Reward grid low" tier, even if the asset is linked to a scope on a higher tier.   A given vulnerability that could be found both on production and non-production environments will only be rewarded once and the second report would be considered duplicate/informative. 

Program Terms

Termination

In the event (i) you breach any of these Program Rules or the terms and conditions of YesWeHack platform; or (ii) Telenor determines, in its sole discretion that your continued participation in the Bug Bounty Program could adversely impact Telenor (including, but not limited to, presenting any threat to Telenor’s systems, security, finances and/or reputation) Telenor may immediately terminate your participation in this Bug Bounty Program.

Confidentiality

Any information you receive or collect about Telenor or any Telenor user through this Bug Bounty Program (“Confidential Information”) must be kept confidential and only used in connection with the program. You may not use, disclose or distribute any such Confidential Information, including, but not limited to, any information regarding your Submission and information you obtain when researching the Telenor sites, without Telenor’s prior written consent.

Changes to Program Rules

The Bug Bounty Program, including its policies, is subject to change or cancellation by Telenor at any time, without notice. As such, Telenor may amend these Program Rules at any time by posting a revised version on YesWeHack platform. By continuing to participate in the Program after Telenor posts any such changes, you accept the Program Terms, as modified.

Contact

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please reach out to [email protected] before going any further.

Out of scope

  • *.bbcust.telenor.se
  • *.cust.telenor.se
  • *.sme.telenor.se
  • *.cust.bredbandsbolaget.se
  • *.customers.ownit.se
  • *.cust.ownit.se
  • *.ownit.nu
  • tc.ownit.se
  • faq.vimla.se
  • status.vimla.se
  • stage-vimla-se.vimla.io
  • admin-stage.tv.telenor.se
  • Any domain that looks like it's owned by a third party or customer due to customer's privacy
  • Mobile services and devices provided by Telenor Sweden and subsidiaries not reachable from Internet
  • Other business units of the Telenor Group - including *.telenor.com

Qualifying vulnerabilities

  • Remote code execution (RCE)
  • Server Side Injection (SSTI, SQLi, PHP, ...)
  • Local files access and manipulation (LFI, RFI, XXE, SSRF, XSPA)
  • Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF) with real security impact
  • Insecure direct object references (IDOR)
  • CORS with real security impact
  • Horizontal and vertical privilege escalation
  • Business Logic Errors
  • Exposed secrets, credentials or sensitive information, disclosed by Telenor, on an asset under our control and affecting at least one of our scopes
  • Authentication bypass and broken access control
  • Cache poisoning or other vulnerabilities that disrupt availability without relying on volumetric attacks or resource exhaustion (e.g., race conditions, algorithmic complexity exploits).
  • User enumeration unless intended design (e.g. registered email addresses in login- or forgot password forms) or clearly public data
  • Open redirection to non-Telenor owned domain

Non-qualifying vulnerabilities

  • Any hypothetical flaw or best practices without exploitable PoC
  • Self reflected injections (i.e., html/xss injection that can't impact others)
  • Mixed content warnings
  • Denial of Service (DoS) attacks that cause degradation of services
  • Social engineering of any kind
  • Presence of autocomplete attribute on web forms
  • TLS / SSL
  • Attacks requiring MITM or physical access to victim's device
  • Issues that require unlikely user interaction
  • Low impact or low-severity Cross-Site Request Forgery (CSRF) attacks
  • Invalid or missing SPF (Sender Policy Framework), DKIM, DMARC records
  • Disclosure of information without direct security impact (e.g. stack traces, path disclosure, directory listings, software versions, IP disclosure, 3rd party secrets)
  • Information disclosure of public or non-protected information (e.g. code in a public repository, server banners, etc.), or information disclosed outside of Telenor's control (e.g. a personal, non-employee repository; a list from a previous infodump; etc.)
  • HTTP Strict Transport Security Header (HSTS)
  • Subdomain takeover without a full working PoC
  • Blind SSRF without direct impact (e.g. DNS pingback)
  • Lack of rate-limiting, brute-forcing or captcha issues
  • Disclosed / Misconfigured API Key without exploitable PoC or business impact
  • Password reset token leak on trusted third-party website via Referer header (e.g. Google Analytics, Facebook…)
  • Stolen secrets, credentials or information gathered from a third-party asset that we have no control over
  • Exposed secrets, credentials or information on an asset under our control that are not applicable to the program’s scope
  • Recently disclosed 0-day vulnerabilities (less than 30 days since patch release)
  • Ability to spam users (email / SMS / direct messages flooding) except through Telenor services.
  • Vulnerabilities affecting outdated browsers or platforms
  • CSV injection
  • Task Hijacking
  • Crashing your own application
  • Lack of client-side protections on mobile binaries: SSL pinning/binary protection/code obfuscation/jailbreak detection/root detection/anti-debugging controls/ etc
  • Lack of encryption on internal databases/preference files on mobile device
  • Exploits that are only possible on Android versions that are not currently supported at the time of the emission of the vulnerability report
  • Exploits that are only possible on IOS versions that are not currently supported at the time of the emission of the vulnerability report
  • Exploits that are only possible on a jailbroken/rooted device
  • Generic Android or iOS vulnerabilities
  • Clickjacking/UI redressing on pages