TikTok · Report #2583874
DOM XSS in tiktok.com/login via the redirect_url parameter
Validstatus
highseverity
140upvotes
21 Sept 2024disclosed
Summary
A DOM Cross-Site Scripting (XSS) vulnerability was found on the redirect_url parameter that could have resulted in account takeover. We thank @sh1yo for reporting this to our team and confirming its resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.