TikTok 路 Report #1010522
[CSRF] TikTok Careers Portal Account Takeover
Validstatus
highseverity
366upvotes
15 Dec 2020disclosed
Summary
A missing CSRF protection and open redirect vulnerability was reported in the TikTok Careers portal single sign on flow which is used by applicants to apply for TikTok positions. This flaw was quickly remediated and does not impact TikTok.com or mobile application. We thank @lauritz for reporting this vulnerability to our team and for confirming the resolution.
I wrote a short blog post that covers this report.
If you have any feedback, feel free to ping me at Twitter. 馃檪
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.