Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| CSRF for deleting videos#998979 | Valid | Cross-Site Request Forgery | Medium | 2020-12-23 | – | 16 |
| URL Scheme misconfiguration on TikTok for IOSAnalysed#1437294 | Valid | Cross-Site Request Forgery | Low | 2022-05-04 | $500 | 18 |
| User In The Same Center Can Create CSRF To Change The Information About BusinessAnalysed#1006306 | Valid | Cross-Site Request Forgery | Low | 2020-12-18 | $147 | 23 |
| CSRF on TikTok Ads PortalAnalysed#1087436 | Valid | Cross-Site Request Forgery | Medium | 2021-05-26 | $1,000 | 23 |
| TikTok Session Donation CSRF via QR code loginAnalysed#1133661 | Valid | Cross-Site Request Forgery | Low | 2021-06-17 | – | 30 |
| CSRF in Changing User Verification EmailAnalysed#1531235 | Valid | Cross-Site Request Forgery | Low | 2022-09-13 | $500 | 37 |
| CSRF To Add New App In Developer Account And Bypassing Json FormatAnalysed#997615 | Valid | Cross-Site Request Forgery | Medium | 2020-11-06 | $200 | 39 |
| CSRF in seller-us.tiktok.com/profile/account-setting/delegation-loginAnalysed#2002352 | Valid | Cross-Site Request Forgery | Medium | 2023-07-26 | – | 41 |
| CSRF protection bypass on TikTok Webcast EndpointsAnalysed#1543234 | Valid | Cross-Site Request Forgery | Medium | 2023-07-12 | $2,500 | 79 |
| CSRF in ticket functionAnalysed#1890310 | Valid | Cross-Site Request Forgery | Medium | 2024-11-05 | – | 80 |
| CSRF Account TakeoverAnalysed#1253462 | Valid | Cross-Site Request Forgery | High | 2022-08-16 | – | 95 |
| [CSRF] TikTok Careers Portal Account TakeoverAnalysed#1010522 | Valid | Cross-Site Request Forgery | High | 2020-12-15 | – | 366 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.