Bug bounty program
TI
TikTok
Most upvoted reports117
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationAnalysed#968082 | Cross-site Scripting | 2020-11-19 | – | 473 |
| Multiple bugs leads to RCE on TikTok for AndroidAnalysed#1065500 | Access Control | 2021-03-17 | – | 371 |
| [CSRF] TikTok Careers Portal Account TakeoverAnalysed#1010522 | Cross-Site Request Forgery | 2020-12-15 | – | 366 |
| Reflected XSS in TikTok endpointsAnalysed#1350887 | Cross-site Scripting | 2021-10-22 | – | 356 |
| RCE on TikTok Ads PortalAnalysed#1024575 | Command and Code Injection | 2021-04-15 | – | 312 |
| Stored-XSS-ads.tiktok.comAnalysed#2306491 | Cross-site Scripting | 2024-10-02 | – | 310 |
| Incorrect authorization to the intelbot service leading to ticket informationAnalysed#1328546 | Authentication | 2022-02-23 | $15,000 | 219 |
| IDOR delete any Tickets on ads.tiktok.comAnalysed#1475520 | Insecure Direct Object Reference | 2022-03-02 | – | 216 |
| Stored XSS on TikTok AdsAnalysed#1504202 | Cross-site Scripting | 2022-08-19 | – | 201 |
| Blocked user can see live videoAnalysed#1067967 | Information Disclosure | 2021-05-28 | $418 | 198 |
Subdomains821
| Name | Scope | First seen |
|---|---|---|
| api.tiktok.comapi | In scope | 2026-11-14 |
| api-m.tiktok.comapi | In scope | 2026-11-14 |
| api-t.tiktok.comapi | In scope | 2026-11-14 |
| api-sg.tiktok.comapi | In scope | 2026-11-14 |
| im-api.tiktok.comapi | In scope | 2026-11-14 |
| ads-api.tiktok.comapi | In scope | 2026-11-14 |
| biz-api.tiktok.comapi | In scope | 2026-11-14 |
| open-api.tiktok.comapi | In scope | 2026-11-14 |
| im-api-sg.tiktok.comapi | In scope | 2026-11-14 |
| im-api-va.tiktok.comapi | In scope | 2026-11-14 |
| api-pns-sg.tiktok.comapi | In scope | 2026-11-14 |
| api-pns-va.tiktok.comapi | In scope | 2026-11-14 |
| api-pns.us.tiktok.comapi | In scope | 2026-11-14 |
| business-api.tiktok.comapi | In scope | 2026-11-14 |
| feelgood-api.tiktok.comapi | In scope | 2026-11-14 |
| api.tiktokv.comapi | In scope | 2026-11-14 |
| api-t.tiktokv.comapi | In scope | 2026-11-14 |
| api15.tiktokv.comapi | In scope | 2026-11-14 |
| api16.tiktokv.comapi | In scope | 2026-11-14 |
| api19.tiktokv.comapi | In scope | 2026-11-14 |
| api21.tiktokv.comapi | In scope | 2026-11-14 |
| api30.tiktokv.comapi | In scope | 2026-11-14 |
| api31.tiktokv.comapi | In scope | 2026-11-14 |
| api32.tiktokv.comapi | In scope | 2026-11-14 |
| api-h2.tiktokv.comapi | In scope | 2026-11-14 |
| api-ru.tiktokv.comapi | In scope | 2026-11-14 |
| api-t1.tiktokv.comapi | In scope | 2026-11-14 |
| api-t2.tiktokv.comapi | In scope | 2026-11-14 |
| api-t3.tiktokv.comapi | In scope | 2026-11-14 |
| api-tl.tiktokv.comapi | In scope | 2026-11-14 |
| api-va.tiktokv.comapi | In scope | 2026-11-14 |
| api3-h2.tiktokv.comapi | In scope | 2026-11-14 |
| oec-api.tiktokv.comapi | In scope | 2026-11-14 |
| api-boot.tiktokv.comapi | In scope | 2026-11-14 |
| api-core.tiktokv.comapi | In scope | 2026-11-14 |
| api15-h2.tiktokv.comapi | In scope | 2026-11-14 |
| api16-va.tiktokv.comapi | In scope | 2026-11-14 |
| api19-h2.tiktokv.comapi | In scope | 2026-11-14 |
| api19-va.tiktokv.comapi | In scope | 2026-11-14 |
| api21-h2.tiktokv.comapi | In scope | 2026-11-14 |
| api21-va.tiktokv.comapi | In scope | 2026-11-14 |
| api22-va.tiktokv.comapi | In scope | 2026-11-14 |
| api30-h2.tiktokv.comapi | In scope | 2026-11-14 |
| api30-va.tiktokv.comapi | In scope | 2026-11-14 |
| api31-va.tiktokv.comapi | In scope | 2026-11-14 |
| api-s1-h2.tiktokv.comapi | In scope | 2026-11-14 |
| api21-quic.tiktokv.comapi | In scope | 2026-11-14 |
| api22-quic.tiktokv.comapi | In scope | 2026-11-14 |
| api-core-ru.tiktokv.comapi | In scope | 2026-11-14 |
| api-core-va.tiktokv.comapi | In scope | 2026-11-14 |
| api-s1-quic.tiktokv.comapi | In scope | 2026-11-14 |
| xdevice-api.tiktokv.comapi | In scope | 2026-11-14 |
| api-h2-eagle.tiktokv.comapi | In scope | 2026-11-14 |
| api16-core-c.tiktokv.comapi | In scope | 2026-11-14 |
| api16-core-i.tiktokv.comapi | In scope | 2026-11-14 |
| api21-core-i.tiktokv.comapi | In scope | 2026-11-14 |
| api21-core-n.tiktokv.comapi | In scope | 2026-11-14 |
| api77-normal.tiktokv.comapi | In scope | 2026-11-14 |
| api16-core-va.tiktokv.comapi | In scope | 2026-11-14 |
| api19-core-va.tiktokv.comapi | In scope | 2026-11-14 |
| api21-core-va.tiktokv.comapi | In scope | 2026-11-14 |
| api22-core-va.tiktokv.comapi | In scope | 2026-11-14 |
| api15-h2-eagle.tiktokv.comapi | In scope | 2026-11-14 |
| api16-normal-c.tiktokv.comapi | In scope | 2026-11-14 |
| api16-normal-i.tiktokv.comapi | In scope | 2026-11-14 |
| api16-normal-n.tiktokv.comapi | In scope | 2026-11-14 |
| api21-h2-eagle.tiktokv.comapi | In scope | 2026-11-14 |
| api22-h2-eagle.tiktokv.comapi | In scope | 2026-11-14 |
| api22-normal-c.tiktokv.comapi | In scope | 2026-11-14 |
| api30-h2-eagle.tiktokv.comapi | In scope | 2026-11-14 |
| api16-normal-v4.tiktokv.comapi | In scope | 2026-11-14 |
| api16-normal-v6.tiktokv.comapi | In scope | 2026-11-14 |
| api22-normal-v4.tiktokv.comapi | In scope | 2026-11-14 |
| api3-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api3-core-n-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api9-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api16-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api16-core-i-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api16-core-n-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api19-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api21-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api21-core-i-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api21-core-n-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api22-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api22-core-h-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api22-core-n-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api24-normal-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api30-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api31-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api31-core-q-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api32-core-q-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api33-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api33-core-q-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api53-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api55-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api58-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api61-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api77-core-c-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api16-core-c4-alisg.tiktokv.comapi | In scope | 2026-11-14 |
| api16-core-c6-alisg.tiktokv.comapi | In scope | 2026-11-14 |
792 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.