- G Chong of TikTok said cache bug reports were closed as low impact because the leaked data looked public and the cache lived under 10 seconds.
- One researcher chained a cached login redirect into a zero-click account takeover, which shows severity depends on the whole chain, not one bug's label.
Calling a bug "low impact" describes a habit of the team that triages it. It is not a fixed fact about the bug. G Chong, who triages bug reports at TikTok, made this argument in a DEF CON 34 bug bounty talk on the DEF CON channel. TikTok closed cache reports as low impact, until one researcher showed a chain that ended in zero-click account takeover. Zero-click means the victim takes no unusual action. They log in as normal, and the attacker does the rest.
What was said
A cache is a store that keeps copies of pages so they load fast. Chong said that over the past year TikTok received many cache reports and closed many as low impact. He gave two reasons. The leaked data was public, such as usernames and follower counts. And TikTok's cache holds a page for under 10 seconds, so an attacker would struggle to keep an attack going.
Two earlier reports on one endpoint were closed as informative for the same reason. Then, in April, a reputable researcher went further. Chong described the chain. An attacker's script polls the endpoint until it gets a cache miss, then waits 15 seconds. In that window a victim logs in. The cache stores the redirect that carries the victim's login code. The attacker reads the code and swaps it for a token. A logic flaw meant the code was never used up.
Chong's point was that risk on paper differs from risk in practice. In his words, "caching and context matters."
Why it matters
Our reading: TikTok's triage tests, as Chong described them, judged each bug alone, by what data it exposed and how long the exposure lasted. His example shows both tests can pass while the real danger sits one step away, in the login flow. Other teams should check whether their own tests do the same. Managers who sign off on closing low-impact reports should ask if the affected endpoint touches authentication.
The people at risk are ordinary users. Their accounts could have been taken over without the victim doing anything beyond a normal login. The researcher also showed he could redirect users to a site he chose. Chong said TikTok raced to patch before the bug could be exploited in the wild. The excerpts do not say whether anyone exploited it. The cost Chong described was effort: his team lost sleep working out the attack and rushing a fix. For teams that buy software or run bug bounties, a closed report is only as good as the question the triager asked.
The other side
This is one team describing its own near miss. The excerpts give no test for telling a harmless cache bug from a dangerous one.
Treating every low-impact cache report as critical would also be costly. Chong did not claim that. The first fix blocked certain URL paths and parameters. He said a clever attacker could get around that kind of block list, and warned: "Just because a report is marked as resolved may not mean that it's actually resolved."
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
