TikTok · Report #1500614
One Click Account Hijacking via Unvalidated Deeplink
Validstatus
highseverity
60upvotes
4 May 2022disclosed
Summary
A WebView Hijacking vulnerability was found on the TikTok Android application via an un-validated deeplink on an un-sanitized parameter. This could have resulted in account hijacking through a JavaScript interface. We thank @fr4via for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.