Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationAnalysed#968082 | Valid | Cross-site Scripting | High | 2020-11-19 | – | 473 |
| Multiple bugs leads to RCE on TikTok for AndroidAnalysed#1065500 | Valid | Access Control | Critical | 2021-03-17 | – | 371 |
| [CSRF] TikTok Careers Portal Account TakeoverAnalysed#1010522 | Valid | Cross-Site Request Forgery | High | 2020-12-15 | – | 366 |
| Reflected XSS in TikTok endpointsAnalysed#1350887 | Valid | Cross-site Scripting | Medium | 2021-10-22 | – | 356 |
| RCE on TikTok Ads PortalAnalysed#1024575 | Valid | Command and Code Injection | Critical | 2021-04-15 | – | 312 |
| Stored-XSS-ads.tiktok.comAnalysed#2306491 | Valid | Cross-site Scripting | Low | 2024-10-02 | – | 310 |
| Incorrect authorization to the intelbot service leading to ticket informationAnalysed#1328546 | Valid | Authentication | Critical | 2022-02-23 | $15,000 | 219 |
| IDOR delete any Tickets on ads.tiktok.comAnalysed#1475520 | Valid | Insecure Direct Object Reference | High | 2022-03-02 | – | 216 |
| Stored XSS on TikTok AdsAnalysed#1504202 | Valid | Cross-site Scripting | Medium | 2022-08-19 | – | 201 |
| Blocked user can see live videoAnalysed#1067967 | Valid | Information Disclosure | Medium | 2021-05-28 | $418 | 198 |
| Reflected XSS on Pangle EndpointAnalysed#2352968 | Valid | Cross-site Scripting | High | 2024-04-05 | $5,000 | 196 |
| TikTok 2FA BypassAnalysed#1247108 | Valid | Access Control | Medium | 2023-02-03 | $1,564 | 194 |
| Account Takeover via Authentication Bypass in TikTok Account RecoveryAnalysed#2443228 | Valid | Authentication | Critical | 2024-07-13 | $12,000 | 172 |
| Unauthorized Access to TikTok Account [Private Videos] via API EndpointAnalysed#2868084 | Valid | Insecure Direct Object Reference | Medium | 2025-01-24 | – | 167 |
| External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processingAnalysed#1062888 | Valid | Server-Side Request Forgery | High | 2021-02-15 | $2,727 | 162 |
| HTML Injection on TikTok AdsAnalysed#2299529 | Valid | Cross-site Scripting | Low | 2024-02-20 | – | 159 |
| DOM XSS in tiktok.com/login via the redirect_url parameterAnalysed#2583874 | Valid | Cross-site Scripting | High | 2024-09-21 | – | 140 |
| IDOR on ads.tiktok.com Allows Unauthorized Product AdditionAnalysed#2848610 | Valid | Insecure Direct Object Reference | Low | 2025-02-20 | $500 | 131 |
| Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended ProductsAnalysed#2295958 | Valid | Input Validation and Logic | Medium | 2024-07-19 | $1,000 | 129 |
| Reflected Cross-site Scripting (XSS) at https://www.tiktok.com/Analysed#1915808 | Valid | Cross-site Scripting | High | 2023-06-02 | – | 123 |
| IDOR for changing privacy settings on any memoriesAnalysed#1733627 | Valid | Insecure Direct Object Reference | High | 2023-01-27 | – | 123 |
| Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/uploadAnalysed#1890284 | Valid | File and Path Handling | Medium | 2023-04-12 | – | 118 |
| Reflected xss on ads.tiktok.com using `from` parameter.Analysed#1452375 | Valid | Cross-site Scripting | High | 2022-02-09 | – | 112 |
| IDOR on TikTok Ads EndpointAnalysed#1527906 | Valid | Insecure Direct Object Reference | Medium | 2022-09-01 | – | 109 |
| Multiple IDORs in family pairing apiAnalysed#1286332 | Valid | Insecure Direct Object Reference | High | 2022-05-06 | – | 107 |
| DOM XSS on ads.tiktok.comAnalysed#1549451 | Valid | Cross-site Scripting | Medium | 2022-07-20 | $2,500 | 104 |
| Lack of rate limitation on careers site allows the attacker to brute force the verification codeAnalysed#1075827 | Valid | Authentication | High | 2021-02-11 | – | 104 |
| Lynxview JS interfaces Takeover via deeplink traversalAnalysed#2417516 | Valid | Cross-site Scripting | High | 2024-05-24 | – | 103 |
| Stored XSS on TikTok's backend leads to the leakage of highly sensitive administrator data (Cookies, API Keys, Internal Paths, Emails, phone numbers).Analysed#3037447 | Valid | Cross-site Scripting | Medium | 2025-09-11 | – | 102 |
| Chain Vulnerability lead to Full Control Group Live Accounts & Undeletable CreatorAnalysed#3027478 | Valid | Access Control | Medium | 2025-07-08 | – | 98 |
| CRLF injection leads to internal XSS on PangleGlobalAnalysed#2189960 | Valid | Injection and Smuggling | Medium | 2023-10-31 | – | 97 |
| CRLF to XSS & Open RedirectionAnalysed#2012519 | Valid | Cross-site Scripting | High | 2023-08-16 | – | 97 |
| HTML Injection on tiktoktutorials via firstName parameterAnalysed#1343492 | Valid | Input Validation and Logic | Low | 2021-10-30 | – | 97 |
| Stored XSS on TikTok Live FormAnalysed#1542703 | Valid | Cross-site Scripting | Medium | 2022-06-16 | – | 95 |
| CSRF Account TakeoverAnalysed#1253462 | Valid | Cross-Site Request Forgery | High | 2022-08-16 | – | 95 |
| Multiple vulnerability leading to account takeover in TikTok SMB subdomain.Analysed#1404612 | Valid | Input Validation and Logic | Critical | 2022-02-02 | – | 91 |
| Chained Broken Access Control in TikTok Live Backstage Enables Full Control of Public Leaderboard ActivitiesAnalysed#3012526 | Valid | Access Control | Medium | 2025-09-11 | – | 89 |
| Reflected XSS on TikTok WebsiteAnalysed#1378413 | Valid | Cross-site Scripting | Medium | 2022-04-13 | $3,000 | 89 |
| Using Branded Hashtag Feature User Partnered with Account Manager Can View Videos Uploaded By A Private TikTok Account If 'item_id' Is KnownAnalysed#2209429 | Valid | Information Disclosure | Medium | 2024-04-03 | – | 87 |
| Authentication Bypass on TikTok Seller Signup Process Allows Account Creation Without Phone VerificationAnalysed#2286745 | Valid | Access Control | Low | 2024-07-03 | – | 84 |
| Cross-Tenant IDOR ( graphql `AddRulesToPixelEvents` query ) allowing to add, update, and delete rules of any Pixel events on the platformAnalysed#984965 | Valid | Insecure Direct Object Reference | High | 2021-04-02 | – | 84 |
| Unauthorized Access to Private Video Description via Translation API for Private AccountsAnalysed#2921830 | Valid | Insecure Direct Object Reference | Low | 2025-06-27 | – | 82 |
| 1 Click to 'Close Account and Refund' via POSTMESSAGEAnalysed#1897443 | Valid | Access Control | Medium | 2024-01-03 | – | 81 |
| CSRF in ticket functionAnalysed#1890310 | Valid | Cross-Site Request Forgery | Medium | 2024-11-05 | – | 80 |
| TikTok's pixel/sdk.js leaks current URL from websites using postMessageAnalysed#1598749 | Valid | Access Control | Medium | 2022-08-30 | – | 79 |
| CSRF protection bypass on TikTok Webcast EndpointsAnalysed#1543234 | Valid | Cross-Site Request Forgery | Medium | 2023-07-12 | $2,500 | 79 |
| Reflected XSS On [https://www-useast1a.tiktok.com/ug/incentive/share/hd]Analysed#2178061 | Valid | Cross-site Scripting | Medium | 2024-01-12 | – | 78 |
| XSS Payload on TikTok Seller Center endpointAnalysed#1554048 | Valid | Cross-site Scripting | Medium | 2022-06-29 | – | 77 |
| Cross-site Scripting (XSS) - Stored on ads.tiktok.com in Text fieldAnalysed#1376961 | Valid | Cross-site Scripting | Medium | 2022-01-20 | – | 75 |
| IDOR the ability to view support tickets of any user on seller platformAnalysed#1392630 | Valid | Insecure Direct Object Reference | Medium | 2021-12-03 | $2,500 | 74 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.