2021-09-14
Broken Access Control in TikTok's Family Pairing Let Me Hijack Any Account's Privacy Settings
An IDOR vulnerability in TikTok's Family Pairing feature allowed an attacker to modify any user's privacy settings — disabling DMs, hiding comments, toggling accounts between public and private — using nothing more than a user ID.
Read more →