TikTok · Report #1286332
Multiple IDORs in family pairing api
Validstatus
highseverity
107upvotes
6 May 2022disclosed
Summary
An IDOR (Insecure Direct Object Reference) vulnerability was found on a TikTok Family Pairing endpoint which could have been used to disable various features. We thank @s3c for reporting this to our team and confirming the fix.
Write up
https://s3c.medium.com/how-i-hacked-world-wide-tiktok-users-24e794d310d2
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.