Skip to content
Connect AISign inSign up free

Bug bounty program

TI

TikTok

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
35
Disclosed reports
117
Subdomains
821
Vendor on CyberSIXT
Tiktok (2 CVEs, 0 exploited)

Most upvoted reports117

All reports
Most upvoted reports of TikTok
ReportWeaknessDisclosedBountyVotes
Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationAnalysed#968082Cross-site Scripting2020-11-19–473
Multiple bugs leads to RCE on TikTok for AndroidAnalysed#1065500Access Control2021-03-17–371
[CSRF] TikTok Careers Portal Account TakeoverAnalysed#1010522Cross-Site Request Forgery2020-12-15–366
Reflected XSS in TikTok endpointsAnalysed#1350887Cross-site Scripting2021-10-22–356
RCE on TikTok Ads PortalAnalysed#1024575Command and Code Injection2021-04-15–312
Stored-XSS-ads.tiktok.comAnalysed#2306491Cross-site Scripting2024-10-02–310
Incorrect authorization to the intelbot service leading to ticket informationAnalysed#1328546Authentication2022-02-23$15,000219
IDOR delete any Tickets on ads.tiktok.comAnalysed#1475520Insecure Direct Object Reference2022-03-02–216
Stored XSS on TikTok AdsAnalysed#1504202Cross-site Scripting2022-08-19–201
Blocked user can see live videoAnalysed#1067967Information Disclosure2021-05-28$418198

Subdomains821

Root
Scope
Name suggests
First seen
Text file821 names
Subdomains of TikTok
NameScopeFirst seen
o33.ptr2870.india.tiktok.comIn scope2026-11-14
o31.ptr4951.service.india.tiktok.comIn scope2026-11-14
o32.ptr7905.service.india.tiktok.comIn scope2026-11-14
info.tiktok.comIn scope2026-11-14
kr-marketing.tiktok.comIn scope2026-11-14
library.tiktok.comIn scope2026-11-14
libraweb-sg.tiktok.comIn scope2026-11-14
libraweb-va.tiktok.comIn scope2026-11-14
lite.tiktok.comIn scope2026-11-14
live.tiktok.comIn scope2026-11-14
live-backstage.tiktok.comIn scope2026-11-14
livecenter.tiktok.comIn scope2026-11-14
livesend.tiktok.comIn scope2026-11-14
login.tiktok.comauthIn scope2026-11-14
lp.tiktok.comIn scope2026-11-14
m.tiktok.comIn scope2026-11-14
o2816.m.tiktok.comIn scope2026-11-14
o2817.m.tiktok.comIn scope2026-11-14
o2818.m.tiktok.comIn scope2026-11-14
o2867.m.tiktok.comIn scope2026-11-14
o2868.m.tiktok.comIn scope2026-11-14
o2869.m.tiktok.comIn scope2026-11-14
mail.tiktok.commailIn scope2026-11-14
maliva.tiktok.comIn scope2026-11-14
marketscope.tiktok.comIn scope2026-11-14
mcs-sg.tiktok.comIn scope2026-11-14
mcs-va.tiktok.comIn scope2026-11-14
media.tiktok.comIn scope2026-11-14
meteor.tiktok.comIn scope2026-11-14
mg.tiktok.comIn scope2026-11-14
mi-marketing.tiktok.comIn scope2026-11-14
mssdk-i18n.tiktok.comIn scope2026-11-14
mssdk-sg.tiktok.comIn scope2026-11-14
mssdk-va.tiktok.comIn scope2026-11-14
music.tiktok.comIn scope2026-11-14
musician.tiktok.comIn scope2026-11-14
mx1.tiktok.comIn scope2026-11-14
mx2.tiktok.comIn scope2026-11-14
mx3.tiktok.comIn scope2026-11-14
news.tiktok.comIn scope2026-11-14
newsroom.tiktok.comIn scope2026-11-14
notes.tiktok.comIn scope2026-11-14
notifications.tiktok.comIn scope2026-11-14
url4367.notifications.tiktok.comIn scope2026-11-14
now.tiktok.comIn scope2026-11-14
nwww.tiktok.comIn scope2026-11-14
open-api.tiktok.comapiIn scope2026-11-14
de-cix.ord.tiktok.comIn scope2026-11-14
p0-dm-sticker-private-us.tiktok.cominternalIn scope2026-11-14
p0-pu-private-useast8.tiktok.cominternalIn scope2026-11-14
p0-tiktok-dm-private-sg.tiktok.cominternalIn scope2026-11-14
partner-sso.tiktok.comauthIn scope2026-11-14
partner-us.tiktok.comIn scope2026-11-14
partners.tiktok.comIn scope2026-11-14
photos.tiktok.comIn scope2026-11-14
pick-pico-i18n.tiktok.comIn scope2026-11-14
polyfill.tiktok.comIn scope2026-11-14
o1.ptr3703.tiktok.comIn scope2026-11-14
rtc.gw.forward.pvt.tiktok.comIn scope2026-11-14
research.tiktok.comIn scope2026-11-14
mtls-fcdn.rtc-gw.tiktok.comIn scope2026-11-14
mtls-row.rtc-gw.tiktok.comIn scope2026-11-14
s16-ies.tiktok.comIn scope2026-11-14
safety-enforcement.tiktok.comIn scope2026-11-14
eu.safety-enforcement.tiktok.comIn scope2026-11-14
scm-us.tiktok.comgitIn scope2026-11-14
accounts.scm-us.tiktok.comgitIn scope2026-11-14
sdk.tiktok.comIn scope2026-11-14
sea-marketing.tiktok.comIn scope2026-11-14
seller.tiktok.comIn scope2026-11-14
seller-br.tiktok.comIn scope2026-11-14
seller-de.tiktok.comIn scope2026-11-14
seller-de-accounts.tiktok.comIn scope2026-11-14
seller-es.tiktok.comIn scope2026-11-14
seller-es-accounts.tiktok.comIn scope2026-11-14
seller-fr.tiktok.comIn scope2026-11-14
seller-fr-accounts.tiktok.comIn scope2026-11-14
seller-id.tiktok.comIn scope2026-11-14
seller-ie.tiktok.comIn scope2026-11-14
seller-ie-accounts.tiktok.comIn scope2026-11-14
seller-it.tiktok.comIn scope2026-11-14
seller-it-accounts.tiktok.comIn scope2026-11-14
seller-mx.tiktok.commailIn scope2026-11-14
seller-my.tiktok.comIn scope2026-11-14
seller-ph.tiktok.comIn scope2026-11-14
seller-sa.tiktok.comIn scope2026-11-14
seller-sandbox.tiktok.comtestIn scope2026-11-14
seller-sg.tiktok.comIn scope2026-11-14
seller-th.tiktok.comIn scope2026-11-14
seller-uk.tiktok.comIn scope2026-11-14
seller-uk-accounts.tiktok.comIn scope2026-11-14
seller-us.tiktok.comIn scope2026-11-14
seller-us-accounts.tiktok.comIn scope2026-11-14
seller-vn.tiktok.comIn scope2026-11-14
service.tiktok.comIn scope2026-11-14
o3.ptr1888.i.service.tiktok.comIn scope2026-11-14
o5.ptr197.i.service.tiktok.comIn scope2026-11-14
o4.ptr4598.i.service.tiktok.comIn scope2026-11-14
tracking.infobip.service.tiktok.comIn scope2026-11-14
o27.ptr1078.service.tiktok.comIn scope2026-11-14

792 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated