<p>Security vulnerabilities in the dating gossip app TeaOnHer have resulted in severe exposure of personal user data, including thousands of driver’s licenses. Within just 10 minutes, researchers identified critical flaws due to an API lacking authentication that allowed unauthorized access. User verification documents were stored on publicly accessible Amazon S3 servers, putting users’ sensitive information at great risk. Initially dismissing the concerns, the developer eventually addressed and rectified the security issues after evidence of the data exposure was presented.</p>
<p>Similarly, a dating advice app, Tea, suffered from significant security breaches. Misconfigured Firebase storage led to the exposure of 72,000 user images, including government IDs, and over a million private messages. Shockingly, a copycat application named TeaOnHer exhibited the same vulnerabilities, highlighting the replication of these critical security flaws. The exposure in both apps resulted in legal challenges and underscored serious deficiencies in mobile app development, particularly in configuring Firebase and ensuring robust data protection measures.</p>


Collections

Security researchers discovered critical vulnerabilities in dating apps TeaOnHer and Tea that exposed thousands of users' personal data, including driver's licenses and private messages. The flaws included unauthenticated APIs and misconfigured Firebase storage that made sensitive user verification documents publicly accessible on Amazon S3 servers. These breaches affected over 72,000 user images and a million private messages, highlighting serious deficiencies in mobile app security practices.

Critical Security Flaws Expose User Data in TeaOnHer and Tea Apps