← All Posts
2021-09-14 · s3c

Broken Access Control in TikTok's Family Pairing Let Me Hijack Any Account's Privacy Settings

In this writeup I'm sharing a TikTok vulnerability I discovered and reported through their bug bounty program — an IDOR in the Family Pairing feature that could have impacted every user on the platform.

What is Family Pairing?

TikTok's Family Pairing feature allows parents to link their account to a younger user's account and control sensitive settings remotely — things like toggling the search bar, switching the account between public and private, controlling direct messages, comments, liked video visibility, and more.

Because these controls touch so many critical account settings, I figured the backend logic would be complex — and complexity is where bugs hide.

Setting Up the Test

I created two accounts: one as the parent, one as the child, and linked them through Family Pairing. Then I fired up Burp Suite to intercept the traffic.

From the parent account, I tried toggling the child account from public to private. When I clicked the button, Burp caught the request.

Analyzing the Request

The request contained a few key parameters:

  • **restriction_type** — which setting to modify:

    • - `1` = Direct messages

    - `2` = Liked videos visibility

    - `3` = Comments

    - `4` = Public/private account toggle

  • **restriction_value** — the new state (e.g. `0`, `1`, `2`, `3` for on/off/no-one)
  • **child_user_id** — the target child account's user ID

    • The Vulnerability

    The server never verified that the `child_user_id` actually belonged to a child account linked to the requesting parent. There was no authorization check on the relationship.

    I swapped the `child_user_id` to a completely unrelated account's user ID, sent the request — and it worked.

    With just an arbitrary user ID, I could now modify any account's privacy settings: flip them from public to private, disable their DMs, hide their comments, control their liked video visibility — all without any connection to the target account.

    Impact

    This was a platform-wide IDOR. An attacker could have:

  • Enumerated TikTok user IDs at scale
  • Forced every account from public to private (or vice versa)
  • Disabled direct messages, comments, and liked video visibility for any user
  • Effectively disrupted the entire ForYou page, lives, and content discovery across the platform

    • The blast radius was every TikTok user worldwide.

    Timeline

  • **Reported** — August 2nd
  • **Bounty Awarded** — August 6th
  • **Resolved** — August 13th

    • TikTok's security team responded quickly and patched the issue within 11 days of the initial report.

    Takeaways

    Family Pairing-style features are high-value targets for access control testing. Any time a platform lets one account control another, the relationship between those accounts must be validated server-side on every request — not just at the time of linking. Always check whether swapping the target ID bypasses authorization.

    References

  • HackerOne Report: https://hackerone.com/reports/1286332
  • Original Writeup: https://s3c.medium.com/how-i-hacked-world-wide-tiktok-users-24e794d310d2