Connect with us

Hi, what are you looking for?



TikTok Awards Nearly $4,000 for Account Takeover Vulnerabilities

TikTok vulnerabilities

Vulnerabilities Could Have Allowed Hackers to Change Passwords of TikTok Accounts 

TikTok vulnerabilities

Vulnerabilities Could Have Allowed Hackers to Change Passwords of TikTok Accounts 

A researcher has earned nearly $4,000 from TikTok after discovering a couple of vulnerabilities that could have been chained to hijack accounts.

Muhammed Taskiran, a 20-year-old researcher based in Germany, informed TikTok in late August that a URL parameter on was “reflecting its value without being properly sanitized.”

This introduced a reflected cross-site scripting (XSS) vulnerability that could have been chained with a cross-site request forgery (CSRF) flaw discovered by Taskiran.

The CSRF issue affected an endpoint that enabled the researcher to set a new password for accounts that had used third-party apps to sign up to the social media service. An attacker could have exploited the vulnerabilities to change an account’s password simply by getting the targeted user to click on a malicious link.

“I combined both vulnerabilities by crafting a simple JavaScript payload – triggering the CSRF – which I injected into the vulnerable URL parameter from earlier, to archive a ‘one click account takeover’,” Taskiran explained in a report submitted to TikTok via the HackerOne platform.

TikTok classified the issue as “high severity” and awarded the researcher $3,860 for his findings. The company has partially disclosed the vulnerability report — very few technical details have been shared.

Advertisement. Scroll to continue reading.

Taskiran also reported two other vulnerabilities to TikTok in recent months, including one that earned him just over $500.

TikTok is offering between $1,700 and $6,900 for high-severity vulnerabilities and between $6,900 and $14,800 for critical vulnerabilities. The company has to date paid out more than $80,000 for 85 vulnerability reports submitted through its recently launched bug bounty program.

The United States government has been trying to ban TikTok due to national security concerns, but the Chinese company is not backing off and it has already won some legal battles.

Related: TikTok and WeChat: Chinese Apps Dogged by Security Fears

Related: China-Made TikTok App Riddled With Security Holes

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

IoT Security

A vulnerability affecting Dahua cameras and video recorders can be exploited by threat actors to modify a device’s system time.