Tl;Dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open

6 hours ago

tl;dv's Firestore database lacks tenant isolation, allowing any authenticated user to query all meeting records.
An attacker can join live meetings uninvited by grabbing conference IDs from the exposed collection.
The author demonstrated by joining a Malaysian Ministry of Education meeting and a US university startup call.
Over 181,000 meeting records from 84,000 users across 35,000 domains, including government and educational institutions, were exposed.
More than 1,000 meetings were public, revealing invitee emails and sensitive content.
A subdomain (worldcup.tldv.io) had zero authentication, leaking employee names and emails.
The vulnerability was reported in January 2026, but the CTO never responded, and it remained unfixed by July 2026.

My Eicher, a fleet management system by Volvo/Eicher joint venture, was found to have unauthenticated internal APIs.
The vulnerability allowed enumeration of 748k customers, 174k users, 676k vehicles, and 2.5 million OTPs.
Attackers could perform account takeover by intercepting OTPs or updating passwords without user notification.

A security researcher discovered an IDOR (Insecure Direct Object Reference) vulnerability in the Click To Pray app, allowing unauthorized access to over 700,000 user accounts' personal information including email addresses, names, and birth dates.
The vulnerability was reported on January 3, 2026, but received no response for six months, and the issue remained unaddressed until after media coverage from Dark Reading in July 2026.
The API endpoint lacked authorization checks, and the signup process returned a validation hash, enabling immediate account verification without email access.

Hugging Face disclosed a hack compromising internal datasets and service credentials.
Attackers exploited a vulnerability via a malicious dataset to escalate permissions and access internal systems.
Stolen credentials have been revoked and rotated; users advised to review their accounts.

A hacker breached Romania's cadastre agency, wiping the entire land registry database after a failed extortion attempt, halting the real-estate market.
Hugging Face was hacked using an autonomous AI agent, stealing internal datasets and cloud credentials, while guardrails hindered their response analysis.
A critical WordPress vulnerability (CVE-2026-63030, wp2shell) allows remote unauthenticated attackers to execute code, affecting versions since last December.

A scan of 7.6 petabytes of public AI training data on Hugging Face found 221,303 live, unique credentials in 6,003 datasets.
The highest-impact secret exposed 393 GB of PII, covering an estimated 3.7% of the global population.
Supply chain risks include 349 live GitHub personal access tokens (223 with full repo write, 130 with CI workflow write, 112 with admin:org, 110 with package publishing) and 318 Docker Hub tokens that can push images.

My Eicher, a fleet management system by Volvo/Eicher joint venture, was found to have unauthenticated internal APIs.
The vulnerability allowed enumeration of 748k customers, 174k users, 676k vehicles, and 2.5 million OTPs.
Attackers could perform account takeover by intercepting OTPs or updating passwords without user notification.

A security researcher discovered an IDOR (Insecure Direct Object Reference) vulnerability in the Click To Pray app, allowing unauthorized access to over 700,000 user accounts' personal information including email addresses, names, and birth dates.
The vulnerability was reported on January 3, 2026, but received no response for six months, and the issue remained unaddressed until after media coverage from Dark Reading in July 2026.
The API endpoint lacked authorization checks, and the signup process returned a validation hash, enabling immediate account verification without email access.

Hugging Face disclosed a hack compromising internal datasets and service credentials.
Attackers exploited a vulnerability via a malicious dataset to escalate permissions and access internal systems.
Stolen credentials have been revoked and rotated; users advised to review their accounts.

A hacker breached Romania's cadastre agency, wiping the entire land registry database after a failed extortion attempt, halting the real-estate market.
Hugging Face was hacked using an autonomous AI agent, stealing internal datasets and cloud credentials, while guardrails hindered their response analysis.
A critical WordPress vulnerability (CVE-2026-63030, wp2shell) allows remote unauthenticated attackers to execute code, affecting versions since last December.

A scan of 7.6 petabytes of public AI training data on Hugging Face found 221,303 live, unique credentials in 6,003 datasets.
The highest-impact secret exposed 393 GB of PII, covering an estimated 3.7% of the global population.
Supply chain risks include 349 live GitHub personal access tokens (223 with full repo write, 130 with CI workflow write, 112 with admin:org, 110 with package publishing) and 318 Docker Hub tokens that can push images.

Hasty Briefsbeta