--- title: TiKTok needs to fix this vulnerability | daily.dev description: TikTok has an unpatched open redirect vulnerability that attackers are actively exploiting in phishing campaigns. The vulnerability allows malicious actors to... canonical: https://daily.dev/posts/tiktok-needs-to-fix-this-vulnerability-tjgohjqsk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: TiKTok needs to fix this vulnerability | daily.dev og:description: TikTok has an unpatched open redirect vulnerability that attackers are actively exploiting in phishing campaigns. The vulnerability allows malicious actors to... og:url: https://daily.dev/posts/tiktok-needs-to-fix-this-vulnerability-tjgohjqsk og:image: https://api.daily.dev/og/posts/tjGohJqSk.png og:image:alt: TiKTok needs to fix this vulnerability og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TiKTok needs to fix this vulnerability **[John Hammond](https://daily.dev/sources/johnhammond)** · 7 min read · 0 upvotes · 0 comments ## Summary TikTok has an unpatched open redirect vulnerability that attackers are actively exploiting in phishing campaigns. The vulnerability allows malicious actors to craft legitimate-looking TikTok URLs that redirect users to attacker-controlled sites, often hosted on AWS S3 buckets. These campaigns typically use social engineering tactics like fake voicemail notifications, leading victims through Cloudflare turnstiles to credential harvesting pages. The phishing kits employ anti-analysis techniques including debugger detection, key blocking, and obfuscated JavaScript to evade security researchers. Despite being publicly documented since September 2024, TikTok has not addressed this vulnerability. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Phishers are hijacking legitimate cloud infrastructure](https://daily.dev/posts/phishers-are-hijacking-legitimate-cloud-infrastructure-zg1zzcupm) · Securelist · 0 upvotes · 0 comments - [Hackers abuse npm mirrors to host phishing redirect pages](https://daily.dev/posts/hackers-abuse-npm-mirrors-to-host-phishing-redirect-pages-qh9bqpbjo) · BleepingComputer · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#aws](https://daily.dev/tags/aws), [#phishing](https://daily.dev/tags/phishing), [#tiktok](https://daily.dev/tags/tiktok) [View this post on daily.dev](https://daily.dev/posts/tiktok-needs-to-fix-this-vulnerability-tjgohjqsk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"TiKTok needs to fix this vulnerability","url":"https://daily.dev/posts/tiktok-needs-to-fix-this-vulnerability-tjgohjqsk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tiktok-needs-to-fix-this-vulnerability-tjgohjqsk"},"datePublished":"2026-02-16T14:32:47.373Z","dateModified":"2026-02-16T14:33:06.541Z","description":"TikTok has an unpatched open redirect vulnerability that attackers are actively exploiting in phishing campaigns. The vulnerability allows malicious actors to...","image":"https://i.ytimg.com/vi/djhX8Q4JuFU/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/djhX8Q4JuFU/sddefault.jpg","isAccessibleForFree":true,"articleSection":"John Hammond","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"John Hammond","logo":"https://media.daily.dev/image/upload/s--Oh7b_KW---/f_auto/v1729363281/logos/johnhammond","url":"https://daily.dev/sources/johnhammond"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tiktok-needs-to-fix-this-vulnerability-tjgohjqsk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,javascript,aws,phishing,tiktok","timeRequired":"PT7M","video":{"@type":"VideoObject","name":"TiKTok needs to fix this vulnerability","description":"TikTok has an unpatched open redirect vulnerability that attackers are actively exploiting in phishing campaigns. The vulnerability allows malicious actors to...","thumbnailUrl":"https://i.ytimg.com/vi/djhX8Q4JuFU/sddefault.jpg","uploadDate":"2026-02-16T14:32:47.373Z","duration":"PT7M","url":"https://api.daily.dev/r/tjGohJqSk","embedUrl":"https://www.youtube.com/embed/djhX8Q4JuFU"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"John Hammond","item":"https://daily.dev/sources/johnhammond"},{"@type":"ListItem","position":3,"name":"TiKTok needs to fix this vulnerability"}]} ```