CRLF to XSS & Open Redirection

Summary

Due to inadequate input validation, it could have been possible to inject CRLF (HTTP Response Splitting) into the parameter "hack_redirect_now " on a TikTok seller endpoint. This could have led to Reflective XSS (Cross-Site Scripting) to gain access to a user's cookies, or the ability to send users to unauthorized webpages ending in "tiktok.com" via an open redirect. This vulnerability has been resolved. We thank @ashrafabdelrazik for reporting this to our team.