TikTok · Report #2209429

Using Branded Hashtag Feature User Partnered with Account Manager Can View Videos Uploaded By A Private TikTok Account If 'item_id' Is Known

Validstatus

mediumseverity

87upvotes

3 Apr 2024disclosed

Summary

The 'branded hashtag challenge' feature on TikTok could have allowed anyone that had been partnered with an account manager to request a TikTok video ID and view the accompanying video. If the ID of a private TikTok video was known and sent, the user would have been shown the private video of another creator. This has been fully remediated. We thank @dxcoder for reporting this to our team.

Using Branded Hashtag Feature on https://ads.tiktok.com. An Attacker Was Able To View Tiktok Videos Uploaded By a Private Account If item_id was known. Thanks to @imran_nisar for the initial discovery of this issue.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original