I can see the dislikes count even though is hidden by YouTube | YouTube ($500)

Description:

When I read the information about the dislike count will be private on December 13th, waiting to test whether the dislike count is private or not.

On December 15th, I try to test, and that's right, I can see the dislike count even though the dislike count is private.

Steps to reproduce:

1. Go to "YouTube Studio".
2. Go to "Copyright" ---> "Removal requests".

URL: https://studio.youtube.com/channel/channel_id/copyright/history

3. Click "New removal request".
4. Click "Add a video".
5. Inspect Element ---> Network.
6. Copy and paste victim video URL to input "YouTube URL of video to be removed.".

    Request:

[POST] https://studio.youtube.com/youtubei/v1/creator/get_creator_videos

"videoIds":["victim_video_id"]

    Response:

likeCount:  "victim_video_like_count"
dislikeCount:  "victim_video_dislike_count"

Will show the dislikes count even though is hidden by YouTube.

PoC video: https://youtu.be/zlcKT3ZzWyk


Timeline:

mm/dd/yyyy

12/15/2021 - Bug Found
12/15/2021 - Submit Report
12/16/2021 - Triaged
    Status: New - Assigned
    Priority: P4 - P2

- 4 Hours Later -

12/16/2021 - 🎉 Nice catch!
    Type: Customer Issue - Bug
    Severity: S4 - S2
    Status: Assigned - Accepted
01/07/2022 - Bounty awarded by Google VRP. ($500)
03/13/2022 - Fixed
    Status: Accepted - Fixed

LinkedIn: Alessandro Rumampuk
YouTube: R,ando
Facebook: Ando
Twitter: R ando

Comments