CVE-2025-63822: SirenGPS Broken Object Level Authorization in account settings API

Vulnerability Overview CVE-2025-63822: SirenGPS Android Broken Object Level Authorization in account settings API Vulnerability Type: Broken Object Level Authorization (BOLA) Affected Application: SirenGPS Android App Affected Version: 2.19.44 Vulnerability Description: During testing, the Android client sent an account identifier in the client-controlled request header when accessing account settings. The backend accepted the provided identifier without adequately verifying whether it belonged to the authenticated session. The observed account identifiers appear to be sequentially assigned rather than being opaque random values, which increases the risk of cross-account enumeration. Attacker Behavior: An authenticated attacker can modify the value in the request to reference another user's sequentially assigned identifier, thereby receiving settings data belonging to other accounts. Impact Scope Successful Exploitation: Allows a remote authenticated attacker to access or modify sensitive information associated with another SirenGPS account. Affected Data: - Profile fields: Name, email address, phone settings, language, address, country, zip code, carrier, notes, and time zone. - Safety and medical fields: Medical history, allergies, special needs, medications, and activity settings. - Alert and notification preferences. - Emergency contact records, including contact name, phone settings, description, and internal contact identifier. Testing Limitations: Testing was limited to accounts created and controlled by the researchers; no real user or third-party user information was involved. Remediation Suggested Server-Side Changes: - Ignore or reject account identifiers provided by the client for account-scoped setting operations. - Bind each request to the authenticated account identity from a trusted server-side session or signed token. - Enforce authorization checks before returning or modifying user settings, medical data, notification preferences, and emergency contacts. - Use non-sequential opaque identifiers, where the identifier is exposed to the client. - Add server-side tests to verify that one account cannot read or modify another account's profile, settings, medical information, notification preferences, or emergency contacts. - Review audit logs for suspicious cross-account access attempts involving account-scoped setting endpoints. Technical Details Host: Method and Path: Client-Controlled Account Identifier Header: Observed Affected Fields Account and Profile Fields: , , , , , , Phone and Message Fields: , , , Address and Carrier Fields: , , , , , , Safety and Medical Fields: , , , , , Alerts and Notifications Fields: , , , , , , Community-Related Fields: , , Emergency Contact Fields: , , , , , Attack Requirements The attacker must possess a valid SirenGPS account and be able to send modified HTTPS requests to the SirenGPS backend. The vulnerability does not require access to the victim's device, network, passwords, or authentication tokens. Affected Versions SirenGPS Android Version: 2.19.44, package name Disclosure Timeline The vendor was contacted multiple times during the coordinated disclosure process. There was no vendor response more than 180 days after the initial disclosure attempt. Evidence Handling The following screenshots show a controlled dual-account test. Sensitive personal values have been blurred prior to publication. References SirenGPS on Google Play Acknowledgments Discovered and reported by: ZhaoLong (Leo) Chu

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-63822: SirenGPS Broken Object Level Authorization in account settings API

More from this source