Bureau Identity accused of exploiting user enumeration flaws to reveal which platforms your phone number is on
kingslyj · x · 2026-11-14
Security researcher @captn3m0 alleges that identity service Bureau Identity snitches on users by exploiting user enumeration vulnerabilities at third-party providers, then exposes an API that reveals whether a given phone number has accounts on Swiggy, Shaadi, Amazon, Instagram, Flipkart, Ajio and others. Screenshots of the API docs show fields like amazon, flipkart and jeevansaathi returning "Account Found / Account Not Found" enums. The researcher asks whether any of these companies even know this is happening — effectively turning account-registration status across platforms into a queryable privacy data point without authorization.
More from Safety
- CodeRabbit's free AI deep scans surface 1,200+ critical flaws across 1,125 open-source repos in 10 days — heyshrutimishra · 2026-11-14
- OpenAI's Control Room Can Kill a Dangerous AI Job in 35 Seconds — iamfakhrealam · 2026-11-14
- Peking University & Tencent release lifecycle survey of generalist agent security — 机器之心 · 2026-11-14
- Reply to Gary Marcus: police bot impersonation, not pronouns — tallmetommy · 2026-11-14
- WhatsApp Desktop auto-download let hackers in without a click — victims share the fix — seanwbren · 2026-11-14
- FAR.AI Frontier Summit brief urges shared minimum standards for safe internal AI deployment — StephenLCasper · 2026-11-14