Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data Exfiltration Analysed #968082 Valid Cross-site Scripting – 2020-11-19 – 473 Multiple bugs leads to RCE on TikTok for Android Analysed #1065500 Valid Access Control – 2021-03-17 – 371 [CSRF] TikTok Careers Portal Account Takeover Analysed #1010522 Valid Cross-Site Request Forgery – 2020-12-15 – 366 Reflected XSS in TikTok endpoints Analysed #1350887 Valid Cross-site Scripting – 2021-10-22 – 356 RCE on TikTok Ads Portal Analysed #1024575 Valid Command and Code Injection – 2021-04-15 – 312 Stored-XSS-ads.tiktok.com Analysed #2306491 Valid Cross-site Scripting Low 2024-10-02 – 310 Incorrect authorization to the intelbot service leading to ticket information Analysed #1328546 Valid Authentication – 2022-02-23 $15,000 219 IDOR delete any Tickets on ads.tiktok.com Analysed #1475520 Valid Insecure Direct Object Reference – 2022-03-02 – 216 Stored XSS on TikTok Ads Analysed #1504202 Valid Cross-site Scripting – 2022-08-19 – 201 Blocked user can see live video Analysed #1067967 Valid Information Disclosure – 2021-05-28 $418 198 Reflected XSS on Pangle Endpoint Analysed #2352968 Valid Cross-site Scripting – 2024-04-05 $5,000 196 TikTok 2FA Bypass Analysed #1247108 Valid Access Control – 2023-02-03 $1,564 194 Account Takeover via Authentication Bypass in TikTok Account Recovery Analysed #2443228 Valid Authentication Critical 2024-07-13 $12,000 172 Unauthorized Access to TikTok Account [Private Videos] via API Endpoint Analysed #2868084 Valid Insecure Direct Object Reference Medium 2025-01-24 – 167 External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processing #1062888 Valid Server-Side Request Forgery – 2021-02-15 $2,727 162 HTML Injection on TikTok Ads #2299529 Valid Cross-site Scripting – 2024-02-20 – 159 DOM XSS in tiktok.com/login via the redirect_url parameter #2583874 Valid Cross-site Scripting High 2024-09-21 – 140 IDOR on ads.tiktok.com Allows Unauthorized Product Addition #2848610 Valid Insecure Direct Object Reference Low 2025-02-20 $500 131 Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended Products #2295958 Valid Input Validation and Logic Medium 2024-07-19 $1,000 129 Reflected Cross-site Scripting (XSS) at https://www.tiktok.com/ #1915808 Valid Cross-site Scripting – 2023-06-02 – 123 IDOR for changing privacy settings on any memories #1733627 Valid Insecure Direct Object Reference – 2023-01-27 – 123 Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/upload #1890284 Valid File and Path Handling – 2023-04-12 – 118 Reflected xss on ads.tiktok.com using `from` parameter. #1452375 Valid Cross-site Scripting – 2022-02-09 – 112 IDOR on TikTok Ads Endpoint #1527906 Valid Insecure Direct Object Reference – 2022-09-01 – 109 Multiple IDORs in family pairing api #1286332 Valid Insecure Direct Object Reference – 2022-05-06 – 107 DOM XSS on ads.tiktok.com #1549451 Valid Cross-site Scripting – 2022-07-20 $2,500 104 Lack of rate limitation on careers site allows the attacker to brute force the verification code #1075827 Valid Authentication – 2021-02-11 – 104 Lynxview JS interfaces Takeover via deeplink traversal #2417516 Valid Cross-site Scripting High 2024-05-24 – 103 Stored XSS on TikTok's backend leads to the leakage of highly sensitive administrator data (Cookies, API Keys, Internal Paths, Emails, phone numbers). #3037447 Valid Cross-site Scripting Medium 2025-09-11 – 102 Chain Vulnerability lead to Full Control Group Live Accounts & Undeletable Creator #3027478 Valid Access Control Medium 2025-07-08 – 98 CRLF injection leads to internal XSS on PangleGlobal #2189960 Valid Injection and Smuggling – 2023-10-31 – 97 CRLF to XSS & Open Redirection #2012519 Valid Cross-site Scripting – 2023-08-16 – 97 HTML Injection on tiktoktutorials via firstName parameter #1343492 Valid Input Validation and Logic – 2021-10-30 – 97 Stored XSS on TikTok Live Form #1542703 Valid Cross-site Scripting – 2022-06-16 – 95 CSRF Account Takeover #1253462 Valid Cross-Site Request Forgery – 2022-08-16 – 95 Multiple vulnerability leading to account takeover in TikTok SMB subdomain. #1404612 Valid Input Validation and Logic – 2022-02-02 – 91 Chained Broken Access Control in TikTok Live Backstage Enables Full Control of Public Leaderboard Activities #3012526 Valid Access Control Medium 2025-09-11 – 89 Reflected XSS on TikTok Website #1378413 Valid Cross-site Scripting – 2022-04-13 $3,000 89 Using Branded Hashtag Feature User Partnered with Account Manager Can View Videos Uploaded By A Private TikTok Account If 'item_id' Is Known #2209429 Valid Information Disclosure – 2024-04-03 – 87 Authentication Bypass on TikTok Seller Signup Process Allows Account Creation Without Phone Verification #2286745 Valid Access Control Low 2024-07-03 – 84 Cross-Tenant IDOR ( graphql `AddRulesToPixelEvents` query ) allowing to add, update, and delete rules of any Pixel events on the platform #984965 Valid Insecure Direct Object Reference – 2021-04-02 – 84 Unauthorized Access to Private Video Description via Translation API for Private Accounts #2921830 Valid Insecure Direct Object Reference Low 2025-06-27 – 82 1 Click to 'Close Account and Refund' via POSTMESSAGE #1897443 Valid Access Control – 2024-01-03 – 81 CSRF in ticket function #1890310 Valid Cross-Site Request Forgery Medium 2024-11-05 – 80 TikTok's pixel/sdk.js leaks current URL from websites using postMessage #1598749 Valid Access Control – 2022-08-30 – 79 CSRF protection bypass on TikTok Webcast Endpoints #1543234 Valid Cross-Site Request Forgery – 2023-07-12 $2,500 79 Reflected XSS On [https://www-useast1a.tiktok.com/ug/incentive/share/hd] #2178061 Valid Cross-site Scripting – 2024-01-12 – 78 XSS Payload on TikTok Seller Center endpoint #1554048 Valid Cross-site Scripting – 2022-06-29 – 77 Cross-site Scripting (XSS) - Stored on ads.tiktok.com in Text field #1376961 Valid Cross-site Scripting – 2022-01-20 – 75 IDOR the ability to view support tickets of any user on seller platform #1392630 Valid Insecure Direct Object Reference – 2021-12-03 $2,500 74