How Cache Poisoning Escalated to Critical Account Takeover in TikToks Web Infrastructure

The talk, given by a member of TikTok's vulnerability management team, challenges the view that web cache poisoning has little real impact. It starts with caching basics such as cache keys and time to live, and explains why earlier reports that exposed only public data or relied on short-lived entries were often closed as low severity.

The core of the talk is three submissions from one researcher against a single OAuth login endpoint. The first abused a redirect loop: the server kept answering with a 302 that carried the OAuth code, the cache stored it, and the attacker could use the code for a zero-click takeover. The team's fix blocked specific paths, and the second report used a malformed state value on an invalid language path to get a cached redirect, creating a one-click variant. The third used path traversal to get around the new rules, and a cached 404 leaked the code through a secondary header. The speaker notes that the mobile OAuth flow had received less scrutiny than web and was the only one affected by the first issue.

The takeaways are practical. Responses that contain user-specific data need cache keys tied to the session, and sensitive endpoints should send no-cache directives even when that costs server load. Caching rules must cover 302 and 404 responses, not only 200s. OAuth state parameters should be checked against a strict allowlist, and teams should fix root causes and test every platform, since a resolved report can still have bypasses.