PETLIBRO: YOUR PET FEEDER IS FEEDING DATA TO ANYONE WHO ASKS

Summary from the TLDR InfoSec newsletter

Smart pet feeders from Petlibro had several serious security flaws that allowed attackers to log in to any account via a broken social-login flow, because the backend trusted client-supplied Google IDs rather than validating OAuth tokens. Attackers could then pull detailed pet profiles, enumerate devices, hijack feeders and cameras, and even harvest owners' recorded mealtime audio messages through poorly authorized APIs. The researcher disclosed six issues, received a small bounty and a post‑hoc NDA request, and criticized Petlibro for leaving the legacy authentication bypass live for weeks in the name of “compatibility” despite the risk to users and their pets.