Security researchers have uncovered a critical account takeover bug in the dating app Grindr, which is designed for gay men. The app stores highly sensitive information such as messages with other users, sexual orientation, HIV status, and photos. The app boasts 27 million users around the globe. The newly disclosed vulnerability could have exposed users to blackmail, extortion, and identity theft.
Researchers found that when a user requests a link to reset their password, Grindr sends the reset token to their browser in response, meaning that an attacker with knowledge of the email used by a Grindr member could easily hijack the account through copying and pasting the reset password token. Cybersecurity researcher Troy Hunt also found that once the password had been reset in the app, he was also able to access the same account on the web. Hunt called the vulnerability one of the most basic account takeover techniques he’d seen.
Read More: Critical Grindr Account Takeover Bug Rings Alarm Bells
