Zoom
Video communications platform providing meetings, webinars, chat, and phone services for enterprise and personal use.
https://zoom.usMax Reward
$50,000
Total Paid
$2,800,000
Resolved
289
Avg Response
3 days
In-Scope Assets
zoom.us
Web portal, scheduling, and recordings
Zoom Client
Desktop and mobile applications
Zoom API
REST API and WebSocket events
Zoom SDK
Video and meeting SDKs
Out of Scope
- ✕ Zoom Marketplace third-party apps
- ✕ Phone hardware
- ✕ Zoom IQ AI features
Severity Levels & Rewards
RCE, authentication bypass, privilege escalation, fund extraction
Stored XSS, CSRF with impact, API abuse, data manipulation
Reflected XSS, data leakage, logic flaws, information disclosure
Verbose errors, minor config issues, low-impact info disclosure
Active Bounties (2)
| ID | Title | Severity | Status | Reward | Submissions |
|---|---|---|---|---|---|
| ZM-001 | Meeting takeover via predictable meeting ID generation | Critical | Resolved | $15,000–$50,000 | 6 |
| ZM-002 | Screen share data exfiltration via malicious virtual background | High | Open | $5,000–$15,000 | 0 |
Rules of Engagement
• Do not access, modify, or delete data belonging to other users.
• Do not perform denial-of-service attacks or automated scanning at high volume.
• Report vulnerabilities promptly and provide sufficient detail to reproduce.
• Allow reasonable time for fix before public disclosure (90 days).
• Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.