Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| TikTok Session Donation CSRF via QR code loginAnalysed#1133661 | Valid | Cross-Site Request Forgery | Low | 2021-06-17 | – | 30 |
| XSS and iframe injection on tiktok ads portal using redirect paramsAnalysed#1514554 | Valid | Cross-site Scripting | Medium | 2022-05-19 | – | 43 |
| RXSS via region parameterAnalysed#2251191 | Valid | Cross-site Scripting | Medium | 2024-01-09 | – | 47 |
| Broken Link on TikTokUS.InfoAnalysed#1338457 | Valid | Misconfiguration and Insecure Design | Low | 2021-10-01 | – | 57 |
| XSS at TikTok Ads EndpointAnalysed#1683129 | Valid | Cross-site Scripting | High | 2023-01-27 | – | 60 |
| Multiple Open Redirect on TikTok domainsAnalysed#2221547 | Valid | Access Control | Low | 2024-02-16 | – | 61 |
| RXSS on TikTok endpointsAnalysed#2280863 | Valid | Cross-site Scripting | Medium | 2024-01-09 | – | 61 |
| Cross Site Scripting using Email parameter in Ads endpoint 1Analysed#953041 | Valid | Cross-site Scripting | Medium | 2020-12-29 | – | 65 |
| XSS on tiktok.comAnalysed#1322104 | Valid | Cross-site Scripting | Medium | 2021-10-23 | – | 72 |
| Reflected XSS On [https://www-useast1a.tiktok.com/ug/incentive/share/hd]Analysed#2178061 | Valid | Cross-site Scripting | Medium | 2024-01-12 | – | 78 |
| CSRF protection bypass on TikTok Webcast EndpointsAnalysed#1543234 | Valid | Cross-Site Request Forgery | Medium | 2023-07-12 | $2,500 | 79 |
| Reflected XSS on TikTok WebsiteAnalysed#1378413 | Valid | Cross-site Scripting | Medium | 2022-04-13 | $3,000 | 89 |
| Multiple vulnerability leading to account takeover in TikTok SMB subdomain.Analysed#1404612 | Valid | Input Validation and Logic | Critical | 2022-02-02 | – | 91 |
| CRLF to XSS & Open RedirectionAnalysed#2012519 | Valid | Cross-site Scripting | High | 2023-08-16 | – | 97 |
| Stored XSS on TikTok's backend leads to the leakage of highly sensitive administrator data (Cookies, API Keys, Internal Paths, Emails, phone numbers).Analysed#3037447 | Valid | Cross-site Scripting | Medium | 2025-09-11 | – | 102 |
| Lack of rate limitation on careers site allows the attacker to brute force the verification codeAnalysed#1075827 | Valid | Authentication | High | 2021-02-11 | – | 104 |
| DOM XSS on ads.tiktok.comAnalysed#1549451 | Valid | Cross-site Scripting | Medium | 2022-07-20 | $2,500 | 104 |
| Reflected xss on ads.tiktok.com using `from` parameter.Analysed#1452375 | Valid | Cross-site Scripting | High | 2022-02-09 | – | 112 |
| Reflected Cross-site Scripting (XSS) at https://www.tiktok.com/Analysed#1915808 | Valid | Cross-site Scripting | High | 2023-06-02 | – | 123 |
| DOM XSS in tiktok.com/login via the redirect_url parameterAnalysed#2583874 | Valid | Cross-site Scripting | High | 2024-09-21 | – | 140 |
| HTML Injection on TikTok AdsAnalysed#2299529 | Valid | Cross-site Scripting | Low | 2024-02-20 | – | 159 |
| Account Takeover via Authentication Bypass in TikTok Account RecoveryAnalysed#2443228 | Valid | Authentication | Critical | 2024-07-13 | $12,000 | 172 |
| Reflected XSS on Pangle EndpointAnalysed#2352968 | Valid | Cross-site Scripting | High | 2024-04-05 | $5,000 | 196 |
| Reflected XSS in TikTok endpointsAnalysed#1350887 | Valid | Cross-site Scripting | Medium | 2021-10-22 | – | 356 |
| Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationAnalysed#968082 | Valid | Cross-site Scripting | High | 2020-11-19 | – | 473 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,187 analysed so far), which can be wrong. Data as of 2026-11-15.