TikTok · Report #2002352
CSRF in seller-us.tiktok.com/profile/account-setting/delegation-login
Validstatus
mediumseverity
41upvotes
26 Jul 2023disclosed
Summary
A Cross-Site Request Forgery (CSRF) vulnerability was found on a US TikTok Seller endpoint which could have resulted in the ability to enable or disable another seller account's delegation mode. We have confirmed resolution of this finding and thank @eye_ for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.