BC Bugcrowd LIVE
Okta
up to$75,000
Open on Bugcrowd ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- managed triage
- yes
- safe harbor
- full
20 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
bugcrowd-pam-###.oktapreview.com | domain | · | · | 2026-09-20 |
bugcrowd-pam-###.pam.oktapreview.com | domain | · | · | 2026-09-20 |
http://app.scaleft.com/ | domain | · | · | 2026-09-20 |
https://bugcrowd-pam-###-admin.oktapreview.com | domain | · | · | 2026-09-20 |
https://bugcrowd-pam-###.at.oktapreview.com | domain | · | · | 2026-09-20 |
https://bugcrowd-pam-###.oktapreview.com | domain | · | · | 2026-09-20 |
https://bugcrowd-pam-###.workflows.oktapreview.com | domain | · | · | 2026-09-20 |
https://support.okta.com | domain | · | · | 2026-09-20 |
https://www.okta.com/products/advanced-server-access/ | domain | · | · | 2026-09-20 |
https://apps.apple.com/us/app/okta-verify/id490179405 | mobile | · | · | 2026-09-20 |
https://play.google.com/store/apps/details?id=com.okta.android.auth&hl=en_US&gl=US | mobile | · | · | 2026-09-20 |
Desktop MFA for Windows | other | · | · | 2026-09-20 |
Desktop MFA for macOS | other | · | · | 2026-09-20 |
Okta On-Prem Agents ( AD, LDAP, RDP, IWA ) | other | · | · | 2026-09-20 |
Okta Verify (Windows) | other | · | · | 2026-09-20 |
Password Sync for macOS | other | · | · | 2026-09-20 |
https://help.okta.com/asa/en-us/Content/Topics/Adv_Server_Access/docs/client.htm | other | · | · | 2026-09-20 |
https://help.okta.com/en/prod/Content/Topics/Adv_Server_Access/docs/sftd-windows.htm | other | · | · | 2026-09-20 |
https://help.okta.com/en/prod/Content/Topics/Settings/download-browser-plugin.htm | other | · | · | 2026-09-20 |
https://www.okta.com/fastpass/ | other | · | · | 2026-09-20 |
18 out of scope — black ICE, don't touch
AtSpoke - Entitlement bundles as a resource in access requestsdomainAtSpoke - Okta Workflows actions in access requestsdomainbugcrowd-%username%-1.oktapreview.comdomainbugcrowd-%username%-2.oktapreview.comdomaindeveloper.okta.comdomainhttps://app.scaleft.com/p/signupdomainhttps://github.com/oktadevdomainhttps://scaleft.comdomainlogin.okta.comdomainpages.okta.comdomainpersonal.trexcloud.comdomaintrust.okta.comdomainwww.okta.com (static site)domainAnything not explicitly called out above as in-scopeotherBackend Okta non-app infrastructureotherNetwork layer issuesother*.okta.comwildcard*.trexcloud.comwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.