{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/124705#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nMultiple vulnerabilities have been identified in the Android application, BaseChat – Audio Dating App, version 9.8.1, which ultimately compromise the privacy of users’ personal data and activity.\r\n\r\n### Description\r\nBaseChat is an online dating platform built in Flutter and targeted toward users over 18. It facilitates anonymous, voice-first interaction between users. Three distinct vulnerabilities have been identified within the shipped Android application.\r\n**VU#124705.1:** The application fails open when validating TLS server certificates for connections to its backend API host. The application allows any self-signed certificate to bypass standard TLS security checks.\r\n**VU#124705.2:** Paid user accounts are mapped to a third-party RevenueCat subscriber database using raw MSISDNs (phone numbers), which are a guessable public identifier. Because the RevenueCat Software Development Kit (SDK) includes a public API key within the application’s Android Package Kit (APK), an attacker can query the RevenueCat’s API using predictable identifiers to retrieve individual user metadata.\r\n**VU#124705.3:** The application writes Personally Identifiable Information (PII) to Android system logs in its production build. During voice calls, the application logs the remote party’s MSISDN through unstripped debug statements, which allows an attacker to recovery phone numbers of callers who are intended to remain anonymous.\r\n\r\n### Impact\r\nImpacts of successful exploitation vary by vulnerability.\r\n**VU#124705.1:** A network-positioned attacker can intercept and modify API communication, potentially leading to account takeover via session credential theft.\r\n**VU#124705.2:** An attacker can locate the public RevenueCat SDK key and query the RevenueCat API using arbitrary phone numbers to retrieve associated user metadata, including activity and purchase history.\r\n**VU#124705.3:** The personal data, or PII, of other users, intended to be anonymous, can be accessed through local system logs. The application’s backend sending other users’ MSISDNs to the client in any capacity presents a privacy violation.\r\nThese vulnerabilities have been confirmed against Basechat – Audio Dating App, Android version 9.8.1.\r\n\r\n### Solution\r\nUnfortunately, Mobile Trading GmbH, the owners of BaseChat, could not be reached to coordinate this vulnerability.\r\n\r\n### Acknowledgements\r\nThanks to Mahmoud Ali Khan for reporting these vulnerabilities. This document was written by Alex Lewis.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/124705"}],"title":"BaseChat – Audio Dating App, Android version 9.8.1, contains multiple vulnerabilities","tracking":{"current_release_date":"2026-11-03T15:42:35+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.52"}},"id":"VU#124705","initial_release_date":"2026-11-03 15:42:35.499013+00:00","revision_history":[{"date":"2026-11-03T15:42:35+00:00","number":"1.20261103154235.1","summary":"Released on 2026-11-03T15:42:35+00:00"}],"status":"final","version":"1.20261103154235.1"}},"vulnerabilities":[{"title":"BaseChat - Audio Dating App, Android version 9.","notes":[{"category":"summary","text":"BaseChat - Audio Dating App, Android version 9.8.1, fails to properly validate TLS server certificates for connections to its backend API host due to permissive badCertificateCallback installs by Dart HttpsOverrides. A network-positioned attacker can intercept and modify API communications intended for the backend."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#124705"}]},{"title":"BaseChat - Audio Dating App, Android version 9.","notes":[{"category":"summary","text":"BaseChat - Audio Dating App, Android version 9.8.1, logs a third-party user’s MSISDN (phone number) and call metadata to Android system logs in production builds via debugPrint. Under local access conditions, personal data of other users can be accessed through local system logs."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#124705"}]},{"title":"BaseChat - Audio Dating App, Android version 9.","notes":[{"category":"summary","text":"BaseChat - Audio Dating App, Android version 9.8.1, maps users’ raw MSISDNs (phone numbers) to a RevenueCat subscriber database via a publicly embedded RevenueCat SDK key. An attacker with access to the SDK key can query the RevenueCat API for arbitrary phone numbers, guessable account identifiers, to retrieve associated metadata of BaseChat users."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#124705"}]}],"product_tree":{"branches":[]}}