TikTok · Report #1328546
Incorrect authorization to the intelbot service leading to ticket information
Validstatus
criticalseverity
$15,000bounty
219upvotes
23 Feb 2022disclosed
Summary
An authentication bypass and site wide stored XSS (cross-site scripting) vulnerability was found on TikTok Ads as JWT (JSON Web Token) was not verified properly. We thank @johnstone for reporting this to our team and confirming its resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.