TikTok · Report #1066607
HTML Injection through Account Name field on TikTok ads portal being rendered on emails
Validstatus
lowseverity
36upvotes
19 Mar 2021disclosed
Summary
The Account Name field on the TikTok Ads Portal did not have restrictions on HTML tag injections which an attacker could have potentially used for phishing attacks. We thank @nagli for reporting this to our team and confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.