TikTok · Report #3027478
Chain Vulnerability lead to Full Control Group Live Accounts & Undeletable Creator
Validstatus
mediumseverity
98upvotes
8 Jul 2025disclosed
Summary
An Insecure Direct Object Reference (IDOR) vulnerability was found on a TikTok LIVE backend platform, which could have resulted in a user gaining access controls beyond their account privileges. We thank @eneri for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.