1 Click to 'Close Account and Refund' via POSTMESSAGE

Summary

A TikTok Ads endpoint sending postmessage sends POST requests without proper checks on the origin. This could have resulted in a cross-site request forgery (CSRF) being used to force another user to send a POST request with any parameters to any end point. This could have been used to close other parties' Ads account. We thank @sinayeganeh for reporting this to our team.