HOW BROKEN OTPS AND OPEN ENDPOINTS TURNED A DATING APP INTO A STALKER'S PLAYGROUND

Summary from the TLDR Web Dev newsletter

There were critical vulnerabilities in the Cerca dating app that exposed sensitive user data like personal messages, passport information, and sexual preferences. Using simple techniques, this developer found an OTP bypass and unprotected API endpoints, allowing for complete account takeover and mass data extraction. The vulnerabilities were later patched.