Bug bounty program
TI
TikTok
Most upvoted reports117
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationAnalysed#968082 | Cross-site Scripting | 2020-11-19 | – | 473 |
| Multiple bugs leads to RCE on TikTok for AndroidAnalysed#1065500 | Access Control | 2021-03-17 | – | 371 |
| [CSRF] TikTok Careers Portal Account TakeoverAnalysed#1010522 | Cross-Site Request Forgery | 2020-12-15 | – | 366 |
| Reflected XSS in TikTok endpointsAnalysed#1350887 | Cross-site Scripting | 2021-10-22 | – | 356 |
| RCE on TikTok Ads PortalAnalysed#1024575 | Command and Code Injection | 2021-04-15 | – | 312 |
| Stored-XSS-ads.tiktok.comAnalysed#2306491 | Cross-site Scripting | 2024-10-02 | – | 310 |
| Incorrect authorization to the intelbot service leading to ticket informationAnalysed#1328546 | Authentication | 2022-02-23 | $15,000 | 219 |
| IDOR delete any Tickets on ads.tiktok.comAnalysed#1475520 | Insecure Direct Object Reference | 2022-03-02 | – | 216 |
| Stored XSS on TikTok AdsAnalysed#1504202 | Cross-site Scripting | 2022-08-19 | – | 201 |
| Blocked user can see live videoAnalysed#1067967 | Information Disclosure | 2021-05-28 | $418 | 198 |
Subdomains821
792 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.