TOPTIKTOK.md

July 18, 2026 ยท View on GitHub

Top reports from TikTok program at HackerOne:

  1. Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data Exfiltration to TikTok - 470 upvotes, $0
  2. Multiple bugs leads to RCE on TikTok for Android to TikTok - 370 upvotes, $0
  3. [CSRF] TikTok Careers Portal Account Takeover to TikTok - 366 upvotes, $0
  4. Reflected XSS in TikTok endpoints to TikTok - 356 upvotes, $0
  5. RCE on TikTok Ads Portal to TikTok - 310 upvotes, $0
  6. Stored-XSS-ads.tiktok.com to TikTok - 310 upvotes, $0
  7. Incorrect authorization to the intelbot service leading to ticket information to TikTok - 218 upvotes, $15000
  8. IDOR delete any Tickets on ads.tiktok.com to TikTok - 216 upvotes, $0
  9. Stored XSS on TikTok Ads to TikTok - 201 upvotes, $0
  10. Blocked user can see live video to TikTok - 197 upvotes, $418
  11. Reflected XSS on Pangle Endpoint to TikTok - 195 upvotes, $5000
  12. TikTok 2FA Bypass to TikTok - 192 upvotes, $1564
  13. Account Takeover via Authentication Bypass in TikTok Account Recovery to TikTok - 169 upvotes, $12000
  14. Unauthorized Access to TikTok Account [Private Videos] via API Endpoint to TikTok - 165 upvotes, $0
  15. External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processing to TikTok - 156 upvotes, $2727
  16. HTML Injection on TikTok Ads to TikTok - 153 upvotes, $0
  17. DOM XSS in tiktok.com/login via the redirect_url parameter to TikTok - 137 upvotes, $0
  18. IDOR on ads.tiktok.com Allows Unauthorized Product Addition to TikTok - 129 upvotes, $500
  19. Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended Products to TikTok - 125 upvotes, $1000
  20. Reflected Cross-site Scripting (XSS) at https://www.tiktok.com/ to TikTok - 123 upvotes, $0
  21. IDOR for changing privacy settings on any memories to TikTok - 120 upvotes, $0
  22. Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/upload to TikTok - 115 upvotes, $0
  23. Reflected xss on ads.tiktok.com using from parameter. to TikTok - 111 upvotes, $0
  24. IDOR on TikTok Ads Endpoint to TikTok - 109 upvotes, $0
  25. Multiple IDORs in family pairing api to TikTok - 107 upvotes, $0
  26. DOM XSS on ads.tiktok.com to TikTok - 104 upvotes, $2500
  27. Lack of rate limitation on careers site allows the attacker to brute force the verification code to TikTok - 104 upvotes, $0
  28. Lynxview JS interfaces Takeover via deeplink traversal to TikTok - 103 upvotes, $0
  29. Stored XSS on TikTok's backend leads to the leakage of highly sensitive administrator data (Cookies, API Keys, Internal Paths, Emails, phone numbers). to TikTok - 100 upvotes, $0
  30. HTML Injection on tiktoktutorials via firstName parameter to TikTok - 97 upvotes, $0
  31. CRLF to XSS & Open Redirection to TikTok - 96 upvotes, $0
  32. CRLF injection leads to internal XSS on PangleGlobal to TikTok - 96 upvotes, $0
  33. Stored XSS on TikTok Live Form to TikTok - 95 upvotes, $0
  34. CSRF Account Takeover to TikTok - 95 upvotes, $0
  35. Chain Vulnerability lead to Full Control Group Live Accounts & Undeletable Creator to TikTok - 95 upvotes, $0
  36. Multiple vulnerability leading to account takeover in TikTok SMB subdomain. to TikTok - 89 upvotes, $0
  37. Reflected XSS on TikTok Website to TikTok - 88 upvotes, $3000
  38. Chained Broken Access Control in TikTok Live Backstage Enables Full Control of Public Leaderboard Activities to TikTok - 88 upvotes, $0
  39. Cross-Tenant IDOR ( graphql AddRulesToPixelEvents query ) allowing to add, update, and delete rules of any Pixel events on the platform to TikTok - 84 upvotes, $0
  40. Using Branded Hashtag Feature User Partnered with Account Manager Can View Videos Uploaded By A Private TikTok Account If 'item_id' Is Known to TikTok - 84 upvotes, $0
  41. Authentication Bypass on TikTok Seller Signup Process Allows Account Creation Without Phone Verification to TikTok - 84 upvotes, $0
  42. CSRF protection bypass on TikTok Webcast Endpoints to TikTok - 79 upvotes, $2500
  43. 1 Click to 'Close Account and Refund' via POSTMESSAGE to TikTok - 79 upvotes, $0
  44. Unauthorized Access to Private Video Description via Translation API for Private Accounts to TikTok - 79 upvotes, $0
  45. TikTok's pixel/sdk.js leaks current URL from websites using postMessage to TikTok - 78 upvotes, $0
  46. XSS Payload on TikTok Seller Center endpoint to TikTok - 77 upvotes, $0
  47. Reflected XSS On [https://www-useast1a.tiktok.com/ug/incentive/share/hd] to TikTok - 77 upvotes, $0
  48. CSRF in ticket function to TikTok - 77 upvotes, $0
  49. Cross-site Scripting (XSS) - Stored on ads.tiktok.com in Text field to TikTok - 75 upvotes, $0
  50. IDOR the ability to view support tickets of any user on seller platform to TikTok - 74 upvotes, $2500
  51. BYPASSING COMMENTING ON RESTRICTED AUDIENCE VIDEOS to TikTok - 72 upvotes, $500
  52. XSS on tiktok.com to TikTok - 72 upvotes, $0
  53. CORS misconfiguration in TikTok ads portal to TikTok - 69 upvotes, $0
  54. Cross Site Scripting using Email parameter in Ads endpoint 1 to TikTok - 65 upvotes, $0
  55. Cross site scripting via file upload in subdomain ads.tiktok.com to TikTok - 64 upvotes, $500
  56. Bypass SMS verification to delete TikTok account to TikTok - 63 upvotes, $0
  57. IDOR on Tagged People to TikTok - 63 upvotes, $0
  58. Privilege Escalation on TikTok for Business to TikTok - 62 upvotes, $0
  59. One Click Account Hijacking via Unvalidated Deeplink to TikTok - 60 upvotes, $0
  60. XSS at TikTok Ads Endpoint to TikTok - 60 upvotes, $0
  61. RXSS on TikTok endpoints to TikTok - 60 upvotes, $0
  62. Multiple Open Redirect on TikTok domains to TikTok - 60 upvotes, $0
  63. Blocked user can send notification by liking the message due to Logical Bug to TikTok - 59 upvotes, $0
  64. Broken Link on TikTokUS.Info to TikTok - 57 upvotes, $0
  65. bypass two-factor authentication in Android apps and web to TikTok - 55 upvotes, $0
  66. HTML Injection via Email Share to TikTok - 53 upvotes, $0
  67. Business Suite "Get Leads" Resulting in Revealing User Email & Phone to TikTok - 51 upvotes, $0
  68. Ability to change permissions across seller platform to TikTok - 47 upvotes, $0
  69. Stored XSS in the ticketing system to TikTok - 46 upvotes, $1000
  70. RXSS via region parameter to TikTok - 46 upvotes, $0
  71. Stored XSS Payload when sending videos to TikTok - 44 upvotes, $0
  72. Bypass "Industry Documents" Validation to TikTok - 43 upvotes, $50
  73. XSS and iframe injection on tiktok ads portal using redirect params to TikTok - 43 upvotes, $0
  74. IDOR in family pairing API to TikTok - 42 upvotes, $0
  75. CSRF in seller-us.tiktok.com/profile/account-setting/delegation-login to TikTok - 41 upvotes, $0
  76. View thumbnail of any private video (friends or followers only) of Private/Public account to TikTok - 40 upvotes, $500
  77. CSRF To Add New App In Developer Account And Bypassing Json Format to TikTok - 39 upvotes, $200
  78. HTML Injection on Company Name on Email to TikTok - 38 upvotes, $79
  79. Lack of session expiration after password reset on TikTok Careers Portal to TikTok - 38 upvotes, $50
  80. CSRF in Changing User Verification Email to TikTok - 37 upvotes, $500
  81. Open Redirect Vulnerability on TikTok Ads Portal to TikTok - 37 upvotes, $0
  82. Unrestricted File Upload Blind Stored Xss in subdomain ads.tiktok.com to TikTok - 36 upvotes, $250
  83. HTML Injection through Account Name field on TikTok ads portal being rendered on emails to TikTok - 36 upvotes, $0
  84. Add products to any livestream. to TikTok - 34 upvotes, $0
  85. Open Redirect TO Stealing aadvid to TikTok - 31 upvotes, $0
  86. IDOR on TikTok Seller to TikTok - 31 upvotes, $0
  87. Bypassing authorization of linked Instagram account to TikTok - 30 upvotes, $170
  88. TikTok Session Donation CSRF via QR code login to TikTok - 30 upvotes, $0
  89. Subdomain Takeover via Unclaimed Amazon S3 Bucket (Musical.ly) to TikTok - 29 upvotes, $200
  90. HTML Injection via TikTok Ads Email Share to TikTok - 29 upvotes, $0
  91. TikTok Account Creation Date Information Disclosure to TikTok - 28 upvotes, $100
  92. Remotely Accessible Container Advisor exposed performance metrics and resource usage to TikTok - 28 upvotes, $100
  93. Internal Employee informations Disclosure via TikTok Athena api to TikTok - 27 upvotes, $1000
  94. Clickjacking Vulnerability Can Leads To Delete Developer APP to TikTok - 26 upvotes, $500
  95. Any user can vote on Friend Only video pull to TikTok - 26 upvotes, $0
  96. IDOR in report download functionality on ads.tiktok.com to TikTok - 25 upvotes, $500
  97. Cross Site Scripting using Email parameter in Ads endpoint 2 to TikTok - 25 upvotes, $0
  98. CSRF on TikTok Ads Portal to TikTok - 23 upvotes, $1000
  99. User In The Same Center Can Create CSRF To Change The Information About Business to TikTok - 23 upvotes, $147
  100. Blind SSRF in ads.tiktok.com to TikTok - 23 upvotes, $0
  101. Rate limiting on report video to TikTok - 22 upvotes, $0
  102. Create product discounts of any shop to TikTok - 21 upvotes, $0
  103. CORS bypass on TikTok Ads Endpoint to TikTok - 19 upvotes, $257
  104. Information Disclosure of Advertiser Account on TikTok Ads Portal to TikTok - 19 upvotes, $0
  105. URL Scheme misconfiguration on TikTok for IOS to TikTok - 18 upvotes, $500
  106. reflected xss on the path m.tiktok.com to TikTok - 18 upvotes, $0
  107. User Able to Reopen a Ticket by Modify the Request to TikTok - 16 upvotes, $169
  108. Multiple Cross-Site Scripting vulnerability via the language parameter to TikTok - 16 upvotes, $0
  109. CSRF for deleting videos to TikTok - 16 upvotes, $0
  110. disclosure the live_analytics information of any livestream. to TikTok - 16 upvotes, $0
  111. Improper user validation on mentions and hashtags to TikTok - 15 upvotes, $0
  112. Information Leakage via TikTok Ads Web Cache Deception to TikTok - 14 upvotes, $0
  113. Email address disclosure via invite token validatiion to TikTok - 11 upvotes, $250
  114. Information Disclosure on TikTok Unplugged Site to TikTok - 11 upvotes, $0
  115. Impersonation of tiktok account via Broken Link in TikTok Newsroom to TikTok - 10 upvotes, $0
  116. Clickjacking Vulnerability In Whole Page Ads Tiktok to TikTok - 7 upvotes, $500
  117. Instance Page DOS within Organization on TikTok Ads to TikTok - 3 upvotes, $0