Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| CSRF in Changing User Verification EmailAnalysed#1531235 | Valid | Cross-Site Request Forgery | Low | 2022-09-13 | $500 | 37 |
| Lack of session expiration after password reset on TikTok Careers PortalAnalysed#997127 | Valid | Authentication | Low | 2021-03-03 | $50 | 38 |
| HTML Injection on Company Name on EmailAnalysed#1022655 | Valid | Cross-site Scripting | Low | 2020-12-31 | $79 | 38 |
| CSRF To Add New App In Developer Account And Bypassing Json FormatAnalysed#997615 | Valid | Cross-Site Request Forgery | Medium | 2020-11-06 | $200 | 39 |
| Bypass "Industry Documents" ValidationAnalysed#997514 | Valid | Access Control | Low | 2020-10-29 | $50 | 43 |
| IDOR in family pairing APIAnalysed#1586950 | Valid | Insecure Direct Object Reference | Low | 2023-06-02 | – | 43 |
| Stored XSS Payload when sending videosAnalysed#1536046 | Valid | Cross-site Scripting | Low | 2022-11-29 | – | 44 |
| Ability to change permissions across seller platformAnalysed#1783001 | Valid | Access Control | Medium | 2022-12-06 | – | 47 |
| bypass two-factor authentication in Android apps and webAnalysed#1747978 | Valid | Authentication | Medium | 2023-01-09 | – | 55 |
| Blocked user can send notification by liking the message due to Logical BugAnalysed#1083421 | Valid | Information Disclosure | Low | 2021-07-10 | – | 59 |
| Privilege Escalation on TikTok for BusinessAnalysed#1505567 | Valid | Insecure Direct Object Reference | Medium | 2022-05-16 | – | 62 |
| IDOR on Tagged PeopleAnalysed#1555376 | Valid | Insecure Direct Object Reference | Medium | 2022-09-20 | – | 63 |
| Bypass SMS verification to delete TikTok accountAnalysed#964467 | Valid | Access Control | Low | 2020-12-23 | – | 64 |
| CORS misconfiguration in TikTok ads portalAnalysed#1006524 | Valid | Access Control | Low | 2020-12-30 | – | 69 |
| BYPASSING COMMENTING ON RESTRICTED AUDIENCE VIDEOSAnalysed#1337351 | Valid | Access Control | Medium | 2021-11-18 | $500 | 72 |
| CSRF in ticket functionAnalysed#1890310 | Valid | Cross-Site Request Forgery | Medium | 2024-11-05 | – | 80 |
| 1 Click to 'Close Account and Refund' via POSTMESSAGEAnalysed#1897443 | Valid | Access Control | Medium | 2024-01-03 | – | 81 |
| Cross-Tenant IDOR ( graphql `AddRulesToPixelEvents` query ) allowing to add, update, and delete rules of any Pixel events on the platformAnalysed#984965 | Valid | Insecure Direct Object Reference | High | 2021-04-02 | – | 84 |
| Authentication Bypass on TikTok Seller Signup Process Allows Account Creation Without Phone VerificationAnalysed#2286745 | Valid | Access Control | Low | 2024-07-03 | – | 84 |
| Using Branded Hashtag Feature User Partnered with Account Manager Can View Videos Uploaded By A Private TikTok Account If 'item_id' Is KnownAnalysed#2209429 | Valid | Information Disclosure | Medium | 2024-04-03 | – | 87 |
| Chained Broken Access Control in TikTok Live Backstage Enables Full Control of Public Leaderboard ActivitiesAnalysed#3012526 | Valid | Access Control | Medium | 2025-09-11 | – | 89 |
| Stored XSS on TikTok Live FormAnalysed#1542703 | Valid | Cross-site Scripting | Medium | 2022-06-16 | – | 95 |
| Chain Vulnerability lead to Full Control Group Live Accounts & Undeletable CreatorAnalysed#3027478 | Valid | Access Control | Medium | 2025-07-08 | – | 98 |
| IDOR for changing privacy settings on any memoriesAnalysed#1733627 | Valid | Insecure Direct Object Reference | High | 2023-01-27 | – | 123 |
| Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended ProductsAnalysed#2295958 | Valid | Input Validation and Logic | Medium | 2024-07-19 | $1,000 | 129 |
| External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processingAnalysed#1062888 | Valid | Server-Side Request Forgery | High | 2021-02-15 | $2,727 | 162 |
| IDOR delete any Tickets on ads.tiktok.comAnalysed#1475520 | Valid | Insecure Direct Object Reference | High | 2022-03-02 | – | 216 |
| Stored-XSS-ads.tiktok.comAnalysed#2306491 | Valid | Cross-site Scripting | Low | 2024-10-02 | – | 310 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,942 analysed so far), which can be wrong. Data as of 2026-11-15.