Work at City of Vienna Managed Bug Bounty? Claim it to respond to reviews as the verified owner.
Found a vulnerability?
If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.
Ask BugRater to submit itPrivate. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.
Reviews
0 publishedNo reviews yet.
Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 19 Sep 2026.
The Vienna City Administration is the largest employer in Vienna. It stands for social responsibility and accountability, reliability, and clear structures. About 67,000 staff members work for the different units and departments of the City Administration and in the city’s independent enterprises – the Vienna Hospital Group, the public housing association Wiener Wohnen, and the local wastewater management. No technology is perfect and City of Vienna believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck, and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Scope
30 assets| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| *.akhwien.at | website | ✓ bounty | not set |
| *.gesundheitsverbund.at | website | ✓ bounty | not set |
| *.magwien.gv.at | website | ✓ bounty | not set |
| *.wien.at | website | ✓ bounty | not set |
| *.wien.gv.at | website | ✓ bounty | not set |
Show all 30 assets
| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| *.wienkav.at | website | ✓ bounty | not set |
| AS16314 | other | ✓ bounty | not set |
| AS6720 1/2 | other | ✓ bounty | not set |
| AS6720 2/2 | other | ✓ bounty | not set |
| AS6720 IPv6 1/2 | other | ✓ bounty | not set |
| AS6720 IPv6 2/2 | other | ✓ bounty | not set |
| City of Vienna Google Play Apps | android | ✓ bounty | not set |
| City of Vienna iOS Apps | ios | ✓ bounty | not set |
| FTAPI Gesundheitsverbund | website | ✓ bounty | not set |
| Mein Wien | website | ✓ bounty | not set |
| Mein Wien API | api | ✓ bounty | not set |
| schulenwien.onmicrosoft.com | other | ✓ bounty | not set |
| Sharepoint Online | website | ✓ bounty | not set |
| stadtwien.onmicrosoft.com | other | ✓ bounty | not set |
| stp.wien.gv.at | website | ✓ bounty | not set |
| Wibi | website | ✓ bounty | not set |
| wien.at | website | ✓ bounty | not set |
| www.akhwien.at | website | ✓ bounty | not set |
| www.gesundheitsverbund.at | website | ✓ bounty | not set |
| www.wien.gv.at | website | ✓ bounty | not set |
| geschichtewiki.wien.gv.at | website | out | not set |
| https://stp.wien.gv.at/geoserverneuogd/* | website | out | not set |
| https://www.wien.gv.at/advuew/* | website | out | not set |
| https://www.wien.gv.at/agssoe/* | website | out | not set |
| Public Network / Veranstaltungsnetz | other | out | not set |