BaseChat Android app has TLS, data mapping, and log vulnerabilities
Original title: VU#124705: BaseChat – Audio Dating App, Android version 9.8.1, contains multiple vulnerabilities
The app fails to validate TLS certificates, maps users via phone numbers, and logs PII in production builds.
CERT/CC identified three vulnerabilities in BaseChat version 9.8.1. VU#124705.1 allows bypassing TLS checks with self-signed certs. VU#124705.2 exposes user data via RevenueCat API. VU#124705.3 logs remote MSISDNs in system logs. The vendor could not be reached for comment.
- VU#124705.1: TLS certificate validation fails open
- VU#124705.2: User metadata retrievable via predictable MSISDNs
- VU#124705.3: PII logged during voice calls
- Confirmed against Android 9.8.1
Impact: exposure of personal data and API access
- 1.Review app permissions and data handling
- Vendors
- Mobile Trading GmbH
- Products
- BaseChat – Audio Dating App
- Organizations
- CERT/CC
From the original article
2 min read at kb.cert.orgOverview Multiple vulnerabilities have been identified in the Android application, BaseChat – Audio Dating App, version 9. 8. 1, which ultimately compromise the privacy of users’ personal data and activity.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.