BRUTE-FORCEABLE AIRLINE RESERVATION API LEFT MILLIONS OF PASSENGER RECORDS VULNERABLE

Summary from the TLDR Dev newsletter

A security researcher discovered a vulnerability in Avelo Airline's reservation API that allowed unauthorized access to passenger data through a brute-force attack due to the lack of last name verification and rate limiting. By exploiting this flaw, an attacker could have potentially accessed millions of passenger records, including PII, government ID numbers, and partial payment data, within a few hours. The researcher responsibly disclosed the vulnerability to Avelo on October 15, who quickly responded and patched the issues by November 13.