TikTok · Report #1543234
CSRF protection bypass on TikTok Webcast Endpoints
Validstatus
mediumseverity
$2,500bounty
79upvotes
12 Jul 2023disclosed
Summary
API on TikTok Webcast endpoints prevent CSRF by validating the Origin header which indicates the source of the request. However, if no Origin header is set, the request will be accepted. This could have resulted in unnoticed requests being sent. We thank @zerody for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.