Cybersecurity Nightmare

A dating app’s OTP login and exposed API endpoints turned routine account access into a stalking-and-identity-theft risk, with attackers able to enumerate users, harvest sensitive profile data, and potentially take over accounts. The core failure was an OTP system that returned one-time codes directly in the authentication response, meaning possession of a phone number alone could be enough to access accounts. From there, guessable user IDs and insufficient access controls on “authenticated” endpoints allowed broad scraping of personal information—phone numbers, match preferences, sexual interests, intimate messages, and even government ID verification details.

After reporting the issues, the researcher says the app’s team acknowledged the severity in a call on February 24, 2025 and promised prompt remediation and user notifications. Follow-up attempts on March 5 and March 13 for updates and plans to inform affected users reportedly went unanswered. By April 21, 2025, the researcher claims there was no public acknowledgement or user alert, despite independent confirmation that the vulnerabilities later appeared patched.

The technical chain of problems began with OTP-based sign-in: the app sent an OTP code in a network response, so anyone intercepting or otherwise obtaining that response could authenticate without needing a secure out-of-band code verification flow. Next, the researcher used the app’s network behavior to locate backend endpoints. An exposed OpenAPI document (served via a /docs endpoint) made the API structure discoverable, and tooling such as Burp Suite was used to replay requests while preserving required headers and bearer tokens.

With endpoints mapped, the researcher reports two major classes of impact. First were business-logic flaws, including an unprotected action that could force matches between users. Second—and more damaging—was a user profile endpoint that accepted a valid user ID and returned extensive personal data. The response included identifying details (names, phone numbers, emails), demographic and education fields (university, university ID, university name), verification statuses (email verified, mobile verified, national ID verified), and relationship-relevant attributes (gender, interested genders, match preferences). The researcher also describes “national ID verified” as especially alarming, claiming the system stored passport or ID information and that it could be viewed once logged in as any user.

To estimate scale, the researcher wrote scripts to enumerate valid user IDs and count users matching certain criteria, including users claiming to be Yale students and users who had submitted ID information. Circa’s own early claim of 10,000 users in the first week is contrasted with the researcher’s ability to find 6,100 users and hundreds with ID data, suggesting the exposure could have been far broader than a small pilot.

The practical consequence is not just data leakage but real-world harm: stalking, blackmail, identity theft, and targeted harassment become easier when intimate messages and government ID details are accessible. The incident also highlights a recurring security lesson for any PII-heavy app: shipping “industry standard” protections is meaningless if authentication flows leak secrets, APIs expose sensitive data without strict authorization checks, and responsible disclosure doesn’t translate into timely remediation and user notification.