TikTok · Report #1498353
View thumbnail of any private video (friends or followers only) of Private/Public account
Validstatus
lowseverity
$500bounty
41upvotes
17 Feb 2023disclosed
Summary
A theoretical attack scenario was found where the thumbnail of any private video could be viewed if the video's setting was "friends/followers only" (not "only me"), and if the video_id parameter was known or bruteforced. We thank @amans for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.