It is highly likely that the developer implementing the vulnerable piece of code would be restricted to modify it either by a license or by inability to do so because of either no sufficient knowledge to modify the code, no access to it or other similar impediments. This being said, you ought to report the vulnerability to the third-party developer who should then take steps to mitigate the issue and push the changes to anyone using the code.
It is recommended that you report the issue to any affected programs or applications, but that's up to you - after all, there aren't any regulations on vulnerability disclosure and the only guideline is your ethical reasoning.
To directly answer your question, if the developer of the vulnerable code is responsible for its maintenance (depending on the software license), they would most likely be the only party who would be willing or eligible to pay you a bounty. However, disclosing the vulnerability to any affected parties is recommended and they might also be willing to reward you depending on the severity of the vulnerability and their ability to mitigate it.