Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Clickjacking Vulnerability In Whole Page Ads Tiktok#1418857 | Valid | Misconfiguration and Insecure Design | Low | 2022-07-07 | $500 | 8 |
| Information Leakage via TikTok Ads Web Cache DeceptionAnalysed#1484468 | Valid | Misconfiguration and Insecure Design | Low | 2022-03-31 | – | 14 |
| CORS bypass on TikTok Ads EndpointAnalysed#1001951 | Valid | Misconfiguration and Insecure Design | Medium | 2020-12-31 | $257 | 19 |
| Clickjacking Vulnerability Can Leads To Delete Developer APPAnalysed#1416612 | Valid | Misconfiguration and Insecure Design | Low | 2022-05-04 | $500 | 27 |
| Broken Link on TikTokUS.InfoAnalysed#1338457 | Valid | Misconfiguration and Insecure Design | Low | 2021-10-01 | – | 57 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.