Browse / TikTok

TikTok

See its reports on the map

Attack surface: 821 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to TikTok

• Cross-site Scripting34
• Access Control18
• Insecure Direct Object Reference17
• Cross-Site Request Forgery12
• Information Disclosure11
• Authentication6

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationCross-site Scripting (XSS) - Reflected · high
   473 votes
2. Multiple bugs leads to RCE on TikTok for AndroidImproper Export of Android Application Components · critical
   371 votes
3. [CSRF] TikTok Careers Portal Account TakeoverCross-Site Request Forgery (CSRF) · high
   366 votes
4. Reflected XSS in TikTok endpointsCross-site Scripting (XSS) - Reflected · medium
   356 votes
5. RCE on TikTok Ads PortalCode Injection · critical
   312 votes
6. Stored-XSS-ads.tiktok.comCross-site Scripting (XSS) - Stored · low
   310 votes
7. Incorrect authorization to the intelbot service leading to ticket informationImproper Authentication - Generic · critical
   $15,000219 votes
8. IDOR delete any Tickets on ads.tiktok.comInsecure Direct Object Reference (IDOR) · high
   216 votes
9. Stored XSS on TikTok AdsCross-site Scripting (XSS) - DOM · medium
   201 votes
10. Blocked user can see live videoPrivacy Violation · medium
    $418198 votes
11. Reflected XSS on Pangle Endpoint Cross-site Scripting (XSS) - Reflected · high
    $5,000196 votes
12. TikTok 2FA BypassImproper Authorization · medium
    $1,564194 votes
13. Account Takeover via Authentication Bypass in TikTok Account RecoveryAuthentication Bypass Using an Alternate Path or Channel · critical
    $12,000172 votes
14. Unauthorized Access to TikTok Account [Private Videos] via API EndpointInsecure Direct Object Reference (IDOR) · medium
    167 votes
15. External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processingServer-Side Request Forgery (SSRF) · high
    $2,727162 votes
16. HTML Injection on TikTok AdsImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · low
    159 votes
17. DOM XSS in tiktok.com/login via the redirect_url parameterCross-site Scripting (XSS) - DOM · high
    140 votes
18. IDOR on ads.tiktok.com Allows Unauthorized Product AdditionInsecure Direct Object Reference (IDOR) · low
    $500131 votes
19. Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended ProductsBusiness Logic Errors · medium
    $1,000129 votes
20. Reflected Cross-site Scripting (XSS) at https://www.tiktok.com/Cross-site Scripting (XSS) - Reflected · high
    123 votes
21. IDOR for changing privacy settings on any memoriesInsecure Direct Object Reference (IDOR) · high
    123 votes
22. Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/uploadUnrestricted Upload of File with Dangerous Type · medium
    118 votes
23. Reflected xss on ads.tiktok.com using `from` parameter.Cross-site Scripting (XSS) - Reflected · high
    112 votes
24. IDOR on TikTok Ads EndpointInsecure Direct Object Reference (IDOR) · medium
    109 votes
25. Multiple IDORs in family pairing apiInsecure Direct Object Reference (IDOR) · high
    107 votes
26. DOM XSS on ads.tiktok.comCross-site Scripting (XSS) - DOM · medium
    $2,500104 votes
27. Lack of rate limitation on careers site allows the attacker to brute force the verification codeImproper Restriction of Authentication Attempts · high
    104 votes
28. Lynxview JS interfaces Takeover via deeplink traversalCross-site Scripting (XSS) - DOM · high
    103 votes
29. Stored XSS on TikTok's backend leads to the leakage of highly sensitive administrator data (Cookies, API Keys, Internal Paths, Emails, phone numbers).Cross-site Scripting (XSS) - Stored · medium
    102 votes
30. Chain Vulnerability lead to Full Control Group Live Accounts & Undeletable CreatorPrivilege Escalation · medium
    98 votes
31. CRLF injection leads to internal XSS on PangleGlobalCRLF Injection · medium
    97 votes
32. CRLF to XSS & Open RedirectionCross-site Scripting (XSS) - Reflected · high
    97 votes
33. HTML Injection on tiktoktutorials via firstName parameterImproper Input Validation · low
    97 votes
34. Stored XSS on TikTok Live FormCross-site Scripting (XSS) - Stored · medium
    95 votes
35. CSRF Account TakeoverCross-Site Request Forgery (CSRF) · high
    95 votes
36. Multiple vulnerability leading to account takeover in TikTok SMB subdomain.Business Logic Errors · critical
    91 votes
37. Chained Broken Access Control in TikTok Live Backstage Enables Full Control of Public Leaderboard ActivitiesPrivilege Escalation · medium
    89 votes
38. Reflected XSS on TikTok WebsiteCross-site Scripting (XSS) - Reflected · medium
    $3,00089 votes
39. Using Branded Hashtag Feature User Partnered with Account Manager Can View Videos Uploaded By A Private TikTok Account If 'item_id' Is KnownInformation Disclosure · medium
    87 votes
40. Authentication Bypass on TikTok Seller Signup Process Allows Account Creation Without Phone VerificationImproper Access Control - Generic · low
    84 votes
41. Cross-Tenant IDOR ( graphql `AddRulesToPixelEvents` query ) allowing to add, update, and delete rules of any Pixel events on the platformInsecure Direct Object Reference (IDOR) · high
    84 votes
42. Unauthorized Access to Private Video Description via Translation API for Private AccountsInsecure Direct Object Reference (IDOR) · low
    82 votes
43. 1 Click to 'Close Account and Refund' via POSTMESSAGEImproper Access Control - Generic · medium
    81 votes
44. CSRF in ticket functionCross-Site Request Forgery (CSRF) · medium
    80 votes
45. TikTok's pixel/sdk.js leaks current URL from websites using postMessageImproper Authorization · medium
    79 votes
46. CSRF protection bypass on TikTok Webcast EndpointsCross-Site Request Forgery (CSRF) · medium
    $2,50079 votes
47. Reflected XSS On [https://www-useast1a.tiktok.com/ug/incentive/share/hd]Cross-site Scripting (XSS) - Reflected · medium
    78 votes
48. XSS Payload on TikTok Seller Center endpointCross-site Scripting (XSS) - Stored · medium
    77 votes
49. Cross-site Scripting (XSS) - Stored on ads.tiktok.com in Text fieldCross-site Scripting (XSS) - Stored · medium
    75 votes
50. IDOR the ability to view support tickets of any user on seller platformInsecure Direct Object Reference (IDOR) · medium
    $2,50074 votes
51. BYPASSING COMMENTING ON RESTRICTED AUDIENCE VIDEOSImproper Access Control - Generic · medium
    $50072 votes
52. XSS on tiktok.comCross-site Scripting (XSS) - Reflected · medium
    72 votes
53. CORS misconfiguration in TikTok ads portal Improper Access Control - Generic · low
    69 votes
54. Cross site scripting via file upload in subdomain ads.tiktok.comCross-site Scripting (XSS) - Stored · low
    $50065 votes
55. Cross Site Scripting using Email parameter in Ads endpoint 1Cross-site Scripting (XSS) - Reflected · medium
    65 votes
56. Bypass SMS verification to delete TikTok accountImproper Authorization · low
    64 votes
57. IDOR on Tagged PeopleInsecure Direct Object Reference (IDOR) · medium
    63 votes
58. Privilege Escalation on TikTok for BusinessInsecure Direct Object Reference (IDOR) · medium
    62 votes
59. RXSS on TikTok endpointsCross-site Scripting (XSS) - Reflected · medium
    61 votes
60. Multiple Open Redirect on TikTok domainsImproper Access Control - Generic · low
    61 votes
61. XSS at TikTok Ads EndpointCross-site Scripting (XSS) - Reflected · high
    60 votes
62. One Click Account Hijacking via Unvalidated DeeplinkForced Browsing · high
    60 votes
63. Blocked user can send notification by liking the message due to Logical BugPrivacy Violation · low
    59 votes
64. Broken Link on TikTokUS.InfoViolation of Secure Design Principles · low
    57 votes
65. bypass two-factor authentication in Android apps and webAuthentication Bypass Using an Alternate Path or Channel · medium
    55 votes
66. HTML Injection via Email ShareImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · low
    53 votes
67. Business Suite "Get Leads" Resulting in Revealing User Email & PhoneInsecure Direct Object Reference (IDOR) · high
    52 votes
68. RXSS via region parameterCross-site Scripting (XSS) - Reflected · medium
    47 votes
69. Ability to change permissions across seller platformImproper Access Control - Generic · medium
    47 votes
70. Stored XSS in the ticketing systemCross-site Scripting (XSS) - Stored · medium
    $1,00046 votes
71. Stored XSS Payload when sending videos Cross-site Scripting (XSS) - Stored · low
    44 votes
72. IDOR in family pairing APIInsecure Direct Object Reference (IDOR) · low
    43 votes
73. XSS and iframe injection on tiktok ads portal using redirect paramsCross-site Scripting (XSS) - Reflected · medium
    43 votes
74. Bypass "Industry Documents" ValidationImproper Access Control - Generic · low
    $5043 votes
75. CSRF in seller-us.tiktok.com/profile/account-setting/delegation-login Cross-Site Request Forgery (CSRF) · medium
    41 votes
76. View thumbnail of any private video (friends or followers only) of Private/Public account Privacy Violation · low
    $50041 votes
77. CSRF To Add New App In Developer Account And Bypassing Json FormatCross-Site Request Forgery (CSRF) · medium
    $20039 votes
78. Unrestricted File Upload Blind Stored Xss in subdomain ads.tiktok.comCross-site Scripting (XSS) - Stored · low
    $25038 votes
79. HTML Injection on Company Name on EmailImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · low
    $7938 votes
80. Lack of session expiration after password reset on TikTok Careers PortalInsufficient Session Expiration · low
    $5038 votes
81. CSRF in Changing User Verification EmailCross-Site Request Forgery (CSRF) · low
    $50037 votes
82. Open Redirect Vulnerability on TikTok Ads Portal Open Redirect · medium
    37 votes
83. HTML Injection through Account Name field on TikTok ads portal being rendered on emailsCode Injection · low
    36 votes
84. Add products to any livestream.Insecure Direct Object Reference (IDOR) · medium
    34 votes
85. IDOR on TikTok SellerInsecure Direct Object Reference (IDOR) · low
    31 votes
86. Open Redirect TO Stealing aadvidOpen Redirect · low
    31 votes
87. Bypassing authorization of linked Instagram accountMissing Authorization · low
    $17030 votes
88. TikTok Session Donation CSRF via QR code loginCross-Site Request Forgery (CSRF) · low
    30 votes
89. HTML Injection via TikTok Ads Email Share Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · medium
    29 votes
90. Subdomain Takeover via Unclaimed Amazon S3 Bucket (Musical.ly)Privilege Escalation · low
    $20029 votes
91. Remotely Accessible Container Advisor exposed performance metrics and resource usageInformation Disclosure · low
    $10028 votes
92. TikTok Account Creation Date Information Disclosure Privacy Violation · low
    $10028 votes
93. Any user can vote on `Friend Only` video pullImproper Authorization · low
    27 votes
94. Internal Employee informations Disclosure via TikTok Athena apiInformation Disclosure · medium
    $1,00027 votes
95. Clickjacking Vulnerability Can Leads To Delete Developer APPUI Redressing (Clickjacking) · low
    $50027 votes
96. IDOR in report download functionality on ads.tiktok.comInsecure Direct Object Reference (IDOR) · low
    $50025 votes
97. Cross Site Scripting using Email parameter in Ads endpoint 2Cross-site Scripting (XSS) - Reflected · medium
    25 votes
98. CSRF on TikTok Ads PortalCross-Site Request Forgery (CSRF) · medium
    $1,00023 votes
99. Blind SSRF in ads.tiktok.comServer-Side Request Forgery (SSRF) · low
    23 votes
100. User In The Same Center Can Create CSRF To Change The Information About BusinessCross-Site Request Forgery (CSRF) · low
     $14723 votes