Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Multiple bugs leads to RCE on TikTok for AndroidAnalysed#1065500 | Valid | Access Control | Critical | 2021-03-17 | – | 371 |
| [CSRF] TikTok Careers Portal Account TakeoverAnalysed#1010522 | Valid | Cross-Site Request Forgery | High | 2020-12-15 | – | 366 |
| RCE on TikTok Ads PortalAnalysed#1024575 | Valid | Command and Code Injection | Critical | 2021-04-15 | – | 312 |
| Incorrect authorization to the intelbot service leading to ticket informationAnalysed#1328546 | Valid | Authentication | Critical | 2022-02-23 | $15,000 | 219 |
| Stored XSS on TikTok AdsAnalysed#1504202 | Valid | Cross-site Scripting | Medium | 2022-08-19 | – | 201 |
| Blocked user can see live videoAnalysed#1067967 | Valid | Information Disclosure | Medium | 2021-05-28 | $418 | 198 |
| TikTok 2FA BypassAnalysed#1247108 | Valid | Access Control | Medium | 2023-02-03 | $1,564 | 194 |
| Unauthorized Access to TikTok Account [Private Videos] via API EndpointAnalysed#2868084 | Valid | Insecure Direct Object Reference | Medium | 2025-01-24 | – | 167 |
| IDOR on ads.tiktok.com Allows Unauthorized Product AdditionAnalysed#2848610 | Valid | Insecure Direct Object Reference | Low | 2025-02-20 | $500 | 131 |
| Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/uploadAnalysed#1890284 | Valid | File and Path Handling | Medium | 2023-04-12 | – | 118 |
| IDOR on TikTok Ads EndpointAnalysed#1527906 | Valid | Insecure Direct Object Reference | Medium | 2022-09-01 | – | 109 |
| Multiple IDORs in family pairing apiAnalysed#1286332 | Valid | Insecure Direct Object Reference | High | 2022-05-06 | – | 107 |
| Lynxview JS interfaces Takeover via deeplink traversalAnalysed#2417516 | Valid | Cross-site Scripting | High | 2024-05-24 | – | 103 |
| CRLF injection leads to internal XSS on PangleGlobalAnalysed#2189960 | Valid | Injection and Smuggling | Medium | 2023-10-31 | – | 97 |
| HTML Injection on tiktoktutorials via firstName parameterAnalysed#1343492 | Valid | Input Validation and Logic | Low | 2021-10-30 | – | 97 |
| CSRF Account TakeoverAnalysed#1253462 | Valid | Cross-Site Request Forgery | High | 2022-08-16 | – | 95 |
| Unauthorized Access to Private Video Description via Translation API for Private AccountsAnalysed#2921830 | Valid | Insecure Direct Object Reference | Low | 2025-06-27 | – | 82 |
| TikTok's pixel/sdk.js leaks current URL from websites using postMessageAnalysed#1598749 | Valid | Access Control | Medium | 2022-08-30 | – | 79 |
| XSS Payload on TikTok Seller Center endpointAnalysed#1554048 | Valid | Cross-site Scripting | Medium | 2022-06-29 | – | 77 |
| Cross-site Scripting (XSS) - Stored on ads.tiktok.com in Text fieldAnalysed#1376961 | Valid | Cross-site Scripting | Medium | 2022-01-20 | – | 75 |
| IDOR the ability to view support tickets of any user on seller platformAnalysed#1392630 | Valid | Insecure Direct Object Reference | Medium | 2021-12-03 | $2,500 | 74 |
| Cross site scripting via file upload in subdomain ads.tiktok.comAnalysed#1433125 | Valid | Cross-site Scripting | Low | 2022-01-25 | $500 | 65 |
| One Click Account Hijacking via Unvalidated DeeplinkAnalysed#1500614 | Valid | Access Control | High | 2022-05-04 | – | 60 |
| HTML Injection via Email ShareAnalysed#1490311 | Valid | Cross-site Scripting | Low | 2022-07-27 | – | 53 |
| Business Suite "Get Leads" Resulting in Revealing User Email & PhoneAnalysed#1744194 | Valid | Insecure Direct Object Reference | High | 2022-11-10 | – | 52 |
| Stored XSS in the ticketing systemAnalysed#1694037 | Valid | Cross-site Scripting | Medium | 2022-10-10 | $1,000 | 46 |
| CSRF in seller-us.tiktok.com/profile/account-setting/delegation-loginAnalysed#2002352 | Valid | Cross-Site Request Forgery | Medium | 2023-07-26 | – | 41 |
| View thumbnail of any private video (friends or followers only) of Private/Public accountAnalysed#1498353 | Valid | Information Disclosure | Low | 2023-02-17 | $500 | 41 |
| Unrestricted File Upload Blind Stored Xss in subdomain ads.tiktok.comAnalysed#1577370 | Valid | Cross-site Scripting | Low | 2022-08-04 | $250 | 38 |
| Open Redirect Vulnerability on TikTok Ads PortalAnalysed#948150 | Valid | Open Redirect | Medium | 2021-01-09 | – | 37 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,699 analysed so far), which can be wrong. Data as of 2026-11-15.