In 2020, TikTok awarded German security researcher Muhammed Taskiran $3,860 for reporting two website vulnerabilities that could potentially be combined to change a targeted account’s password after the user clicked a malicious link. SecurityWeek reported that TikTok rated the finding high severity. The described chain affected a password-setting endpoint for accounts created through third-party apps; it was not a claim that every TikTok account was vulnerable or that attackers had used the flaws against real users.
What the 2020 TikTok report described
SecurityWeek’s November 23, 2020 report said Taskiran found a reflected cross-site scripting (XSS) flaw on tiktok.com and a cross-site request forgery (CSRF) flaw affecting a password-setting endpoint. The reported endpoint applied to accounts registered through third-party apps. SecurityWeek described the two flaws as a chain that could potentially let an attacker change a targeted account’s password if the person clicked a malicious link. SecurityWeek’s report did not say that this chain was used to compromise real users.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Visa Virtual eGift Card | $105.95 | Buy on Amazon |
| 2 |
|
Visa Virtual eGift Card | $206.95 | Buy on Amazon |
| 3 |
|
Visa Virtual eGift Card | $28.95 | Buy on Amazon |
| 4 |
|
Visa Virtual eGift Card | $54.95 | Buy on Amazon |
Taskiran described his report as a “one click account takeover,” as quoted by SecurityWeek. That phrase characterizes the reported scenario; it is not an independently verified account of an actual attack. The technical disclosure was partial, so the public account does not provide enough detail to reconstruct or independently verify every step of the exploit.
How much TikTok paid—and what the figures mean
SecurityWeek reported that TikTok classified the finding as high severity and paid Taskiran $3,860 in 2020. The article also gave the program’s then-reported reward ranges and total payouts:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
- Visa Virtual eGift Cards are designed for online use only. Gift Cards are subject to Terms and Conditions: a.co/5bw3qXJ
- When you access your Visa Virtual eGift Card for the first time, you’ll need to register your name, address, phone number, and email address via activationspot.com. These details should also be used as your billing address for online purchases, as many merchants require address verification for purchase authorization.
- This Visa Virtual eGift Card is non-reloadable. No cash or ATM access. Visa Virtual eGift Cards are emailed active.
- Funds do not expire but your Visa Virtual eGift Card has a ‘valid thru’ date (9 years from date of purchase). If funds remain after this date has passed, please call the Toll Free number found on your Visa Virtual eGift Card for a replacement card. A one-time purchase fee applies at the time of checkout.
- This item is not eligible for refund, resale, or return. Available for sale within the United States only. Not available to residents of Puerto Rico, Hawaii, New Mexico, South Dakota, West Virginia and the US Virgin Islands.
| Figure | What it refers to |
|---|---|
| $3,860 | The award to Taskiran for the 2020 report, according to SecurityWeek. |
| $1,700–$6,900 | SecurityWeek’s reported 2020 range for high-severity reports; it is not a verified current rate. |
| $6,900–$14,800 | SecurityWeek’s reported 2020 range for critical reports; it is not a verified current rate. |
| More than $80,000 for 85 reports | The program total SecurityWeek reported at that time, not a current cumulative total. |
These figures describe the program as reported in November 2020. TikTok’s current help page does not publish reward amounts; it sends researchers to HackerOne for the live program’s terms.
How to report a security issue to TikTok now
TikTok’s security issues help page says technical security bugs affecting its app or website can be reported through HackerOne. TikTok states, “TikTok follows a Coordinated Disclosure Policy.” The help page lists issue types including XSS, CSRF, authentication or authorization vulnerabilities, user-data leaks, and dangerous APIs, and points to the HackerOne policy for current scope, program rules, rewards, and disclosure terms.
Rank #2
- Visa Virtual eGift Cards are designed for online use only. Gift Cards are subject to Terms and Conditions: a.co/5bw3qXJ
- When you access your Visa Virtual eGift Card for the first time, you’ll need to register your name, address, phone number, and email address via activationspot.com. These details should also be used as your billing address for online purchases, as many merchants require address verification for purchase authorization.
- This Visa Virtual eGift Card is non-reloadable. No cash or ATM access. Visa Virtual eGift Cards are emailed active.
- Funds do not expire but your Visa Virtual eGift Card has a ‘valid thru’ date (9 years from date of purchase). If funds remain after this date has passed, please call the Toll Free number found on your Visa Virtual eGift Card for a replacement card. A one-time purchase fee applies at the time of checkout.
- This item is not eligible for refund, resale, or return. Available for sale within the United States only. Not available to residents of Puerto Rico, Hawaii, New Mexico, South Dakota, West Virginia and the US Virgin Islands.
Because eligibility and scope can change, read the current HackerOne policy before submitting a report. Do not assume that the 2020 reward ranges apply today, or test accounts, systems, or data without authorization.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Do not confuse this with TikTok’s 2022 Android vulnerability
The 2020 website XSS/CSRF report is distinct from a separate Android account-hijacking issue disclosed by Microsoft in 2022 and assigned CVE-2022-28799. Microsoft said it notified TikTok in February 2022, that TikTok fixed the issue in an app update released less than a month later, and that it found no evidence of exploitation in the wild. That Android issue has a different date and mechanism from Taskiran’s 2020 report. Microsoft’s 2022 account discusses that separate finding.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Rank #4
- Visa Virtual eGift Cards are designed for online use only. Gift Cards are subject to Terms and Conditions: a.co/5bw3qXJ
- When you access your Visa Virtual eGift Card for the first time, you’ll need to register your name, address, phone number, and email address via activationspot.com. These details should also be used as your billing address for online purchases, as many merchants require address verification for purchase authorization.
- This Visa Virtual eGift Card is non-reloadable. No cash or ATM access. Visa Virtual eGift Cards are emailed active.
- Funds do not expire but your Visa Virtual eGift Card has a ‘valid thru’ date (9 years from date of purchase). If funds remain after this date has passed, please call the Toll Free number found on your Visa Virtual eGift Card for a replacement card. A one-time purchase fee applies at the time of checkout.
- This item is not eligible for refund, resale, or return. Available for sale within the United States only. Not available to residents of Puerto Rico, Hawaii, New Mexico, South Dakota, West Virginia and the US Virgin Islands.
Rank #3
- Visa Virtual eGift Cards are designed for online use only. Gift Cards are subject to Terms and Conditions: a.co/5bw3qXJ
- When you access your Visa Virtual eGift Card for the first time, you’ll need to register your name, address, phone number, and email address via activationspot.com. These details should also be used as your billing address for online purchases, as many merchants require address verification for purchase authorization.
- This Visa Virtual eGift Card is non-reloadable. No cash or ATM access. Visa Virtual eGift Cards are emailed active.
- Funds do not expire but your Visa Virtual eGift Card has a ‘valid thru’ date (9 years from date of purchase). If funds remain after this date has passed, please call the Toll Free number found on your Visa Virtual eGift Card for a replacement card. A one-time purchase fee applies at the time of checkout.
- This item is not eligible for refund, resale, or return. Available for sale within the United States only. Not available to residents of Puerto Rico, Hawaii, New Mexico, South Dakota, West Virginia and the US Virgin Islands.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
