TikTok · Report #1133661
TikTok Session Donation CSRF via QR code login
Validstatus
lowseverity
30upvotes
17 Jun 2021disclosed
Summary
A CSRF (Cross Site Request Forgery) vulnerability was reported in TikTok's QR code login which could have potentially caused a user to log into an attacker-controlled account. We thank @lauritz for reporting this to our team and confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.