Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Instance Page DOS within Organization on TikTok Ads#1478930 | Valid | Denial of Service | – | 2022-03-17 | – | 3 |
| Clickjacking Vulnerability In Whole Page Ads Tiktok#1418857 | Valid | Misconfiguration and Insecure Design | – | 2022-07-07 | $500 | 8 |
| Impersonation of tiktok account via Broken Link in TikTok Newsroom#1504294 | Valid | Input Validation and Logic | – | 2022-03-24 | – | 10 |
| Information Disclosure on TikTok Unplugged Site#1249050 | Valid | Information Disclosure | – | 2021-08-13 | – | 11 |
| Email address disclosure via invite token validatiion#1560072 | Valid | Information Disclosure | – | 2022-06-11 | $250 | 11 |
| Information Leakage via TikTok Ads Web Cache Deception#1484468 | Valid | Misconfiguration and Insecure Design | – | 2022-03-31 | – | 14 |
| Multiple Cross-Site Scripting vulnerability via the language parameter#953053 | Valid | Cross-site Scripting | – | 2020-12-21 | – | 16 |
| CSRF for deleting videos#998979 | Valid | Cross-Site Request Forgery | – | 2020-12-23 | – | 16 |
| User Able to Reopen a Ticket by Modify the Request#998993 | Valid | Access Control | – | 2020-12-18 | $169 | 16 |
| disclosure the live_analytics information of any livestream.#1561299 | Valid | Information Disclosure | – | 2022-06-11 | – | 16 |
| Improper user validation on mentions and hashtags#1610316 | Valid | Input Validation and Logic | – | 2023-06-22 | – | 16 |
| reflected xss on the path m.tiktok.com#1394440 | Valid | Cross-site Scripting | – | 2021-12-03 | – | 18 |
| URL Scheme misconfiguration on TikTok for IOS#1437294 | Valid | Cross-Site Request Forgery | – | 2022-05-04 | $500 | 18 |
| CORS bypass on TikTok Ads Endpoint#1001951 | Valid | Misconfiguration and Insecure Design | – | 2020-12-31 | $257 | 19 |
| Information Disclosure of Advertiser Account on TikTok Ads Portal#1018608 | Valid | Information Disclosure | – | 2021-01-20 | – | 19 |
| Create product discounts of any shop#1571578 | Valid | Insecure Direct Object Reference | – | 2022-09-21 | – | 21 |
| Rate limiting on report video#948146 | Valid | Authentication | – | 2021-02-02 | – | 22 |
| User In The Same Center Can Create CSRF To Change The Information About Business#1006306 | Valid | Cross-Site Request Forgery | – | 2020-12-18 | $147 | 23 |
| Blind SSRF in ads.tiktok.com#1006599 | Valid | Server-Side Request Forgery | – | 2020-12-17 | – | 23 |
| CSRF on TikTok Ads Portal#1087436 | Valid | Cross-Site Request Forgery | – | 2021-05-26 | $1,000 | 23 |
| Cross Site Scripting using Email parameter in Ads endpoint 2#946160 | Valid | Cross-site Scripting | – | 2020-12-30 | – | 25 |
| IDOR in report download functionality on ads.tiktok.com#1559739 | Valid | Insecure Direct Object Reference | – | 2022-07-22 | $500 | 25 |
| Clickjacking Vulnerability Can Leads To Delete Developer APP#1416612 | Valid | Misconfiguration and Insecure Design | – | 2022-05-04 | $500 | 27 |
| Internal Employee informations Disclosure via TikTok Athena api#1575560 | Valid | Information Disclosure | – | 2022-07-20 | $1,000 | 27 |
| Any user can vote on `Friend Only` video pull#1793940 | Valid | Access Control | – | 2023-01-27 | – | 27 |
| TikTok Account Creation Date Information Disclosure#1562020 | Valid | Information Disclosure | – | 2022-10-18 | $100 | 28 |
| Remotely Accessible Container Advisor exposed performance metrics and resource usage#1697599 | Valid | Information Disclosure | – | 2022-10-24 | $100 | 28 |
| Subdomain Takeover via Unclaimed Amazon S3 Bucket (Musical.ly)#1102537 | Valid | Access Control | – | 2022-11-07 | $200 | 29 |
| HTML Injection via TikTok Ads Email Share#1376990 | Valid | Cross-site Scripting | – | 2022-07-28 | – | 29 |
| TikTok Session Donation CSRF via QR code login#1133661 | Valid | Cross-Site Request Forgery | – | 2021-06-17 | – | 30 |
| Bypassing authorization of linked Instagram account#1199965 | Valid | Access Control | – | 2022-09-30 | $170 | 30 |
| Open Redirect TO Stealing aadvid#1378533 | Valid | Open Redirect | – | 2022-03-02 | – | 31 |
| IDOR on TikTok Seller#1509057 | Valid | Insecure Direct Object Reference | – | 2022-08-16 | – | 31 |
| Add products to any livestream.#1654657 | Valid | Insecure Direct Object Reference | – | 2022-09-21 | – | 34 |
| HTML Injection through Account Name field on TikTok ads portal being rendered on emails#1066607 | Valid | Command and Code Injection | – | 2021-03-19 | – | 36 |
| Open Redirect Vulnerability on TikTok Ads Portal#948150 | Valid | Open Redirect | – | 2021-01-09 | – | 37 |
| CSRF in Changing User Verification Email#1531235 | Valid | Cross-Site Request Forgery | – | 2022-09-13 | $500 | 37 |
| Lack of session expiration after password reset on TikTok Careers Portal#997127 | Valid | Authentication | – | 2021-03-03 | $50 | 38 |
| HTML Injection on Company Name on Email#1022655 | Valid | Cross-site Scripting | – | 2020-12-31 | $79 | 38 |
| Unrestricted File Upload Blind Stored Xss in subdomain ads.tiktok.com#1577370 | Valid | Cross-site Scripting | – | 2022-08-04 | $250 | 38 |
| CSRF To Add New App In Developer Account And Bypassing Json Format#997615 | Valid | Cross-Site Request Forgery | – | 2020-11-06 | $200 | 39 |
| View thumbnail of any private video (friends or followers only) of Private/Public account#1498353 | Valid | Information Disclosure | – | 2023-02-17 | $500 | 41 |
| CSRF in seller-us.tiktok.com/profile/account-setting/delegation-login#2002352 | Valid | Cross-Site Request Forgery | – | 2023-07-26 | – | 41 |
| Bypass "Industry Documents" Validation#997514 | Valid | Access Control | – | 2020-10-29 | $50 | 43 |
| XSS and iframe injection on tiktok ads portal using redirect params#1514554 | Valid | Cross-site Scripting | – | 2022-05-19 | – | 43 |
| IDOR in family pairing API#1586950 | Valid | Insecure Direct Object Reference | – | 2023-06-02 | – | 43 |
| Stored XSS Payload when sending videos#1536046 | Valid | Cross-site Scripting | – | 2022-11-29 | – | 44 |
| Stored XSS in the ticketing system#1694037 | Valid | Cross-site Scripting | – | 2022-10-10 | $1,000 | 46 |
| Ability to change permissions across seller platform#1783001 | Valid | Access Control | – | 2022-12-06 | – | 47 |
| RXSS via region parameter#2251191 | Valid | Cross-site Scripting | – | 2024-01-09 | – | 47 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.