TikTok · Report #1598749
TikTok's pixel/sdk.js leaks current URL from websites using postMessage
Validstatus
mediumseverity
79upvotes
30 Aug 2022disclosed
Summary
A vulnerability was found where an oauth token could have been leaked due to an origin check bypass in the TikTok Pixel SDK. We thank @fransrosen for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.