TikTok · disclosed reports
Information Disclosure
11 disclosed reports · $2,368 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open TikTok on HackerOne- reports
- 11
- valid
- 0
- paid a bounty
- 6
Every one of the 11 is a mark on the map. Named now: 1 to 11, most upvoted first.
- Blocked user can see live video
- Using Branded Hashtag Feature User Partnered with Account Manager Can View Videos Uploaded By A Private TikTok Account If 'item_id' Is Known
- Blocked user can send notification by liking the message due to Logical Bug
- View thumbnail of any private video (friends or followers only) of Private/Public account
- Remotely Accessible Container Advisor exposed performance metrics and resource usage
- TikTok Account Creation Date Information Disclosure
- Internal Employee informations Disclosure via TikTok Athena api
- Information Disclosure of Advertiser Account on TikTok Ads Portal
- disclosure the live_analytics information of any livestream.
- Email address disclosure via invite token validatiion
- Information Disclosure on TikTok Unplugged Site
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP