Critical Flaws in Freedom Chat App Exposed User Identifiers & PINs

What good is a "secure" messaging app if it broadcasts your private phone number to any curious attacker and hands them the PIN to unlock your device? Freedom Chat, an app marketed as privacy-focused, failed these basic tests due to elementary API security flaws.

A phone number enumeration flaw in Freedom Chat's API allowed an attacker to confirm if any phone number was registered by flooding the server with guesses, exposing nearly 2,000 users.
A severe PIN leakage flaw caused the app's backend to respond with the PIN codes of all users in a public channel, broadcasting them in network traffic.
The vulnerabilities, discovered by researcher Eric Daigle, were reported via TechCrunch as the vendor lacks a public disclosure program.
The vendor has reset all user PINs and deployed server-side fixes, but the incident reveals critical gaps in their security design and response posture.

Technical Summary

Security researcher Eric Daigle identified two critical vulnerabilities in the Freedom Chat mobile messaging application that collectively compromised user anonymity and device security. The flaws stem from a fundamental lack of security controls on the application's backend API and improper data handling.

The first vulnerability, CWE-203: Observable Discrepancy, was an insecure user enumeration flaw. Freedom Chat's authentication endpoint did not implement rate limiting or consistent error messages, allowing an attacker to brute-force phone numbers and determine which were registered to the service. This technique directly mirrors recent academic research used to scrape WhatsApp user data.

The second, more severe flaw was CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. By intercepting the app's network traffic, Daigle discovered that when a user joined a public channel, the server's response contained the app-locking PIN codes of every other user in that channel. This data was not displayed in the UI but was transmitted in plaintext within the API response, making it accessible to anyone on the network or with the ability to inspect device traffic.

Observed Evidence & Timeline

Early December 2025: Security researcher Eric Daigle discovers the phone number enumeration and PIN leakage vulnerabilities in the Freedom Chat app.
Last Week (Week of Dec 4): Daigle completes analysis and documents findings. He attempts to report the issues but finds Freedom Chat has no public vulnerability disclosure program.
Date Unspecified: TechCrunch is contacted by Daigle and subsequently alerts Freedom Chat founder Tanner Haas via email.
December 11, 2025: TechCrunch publishes the findings. Freedom Chat confirms fixes have been deployed, including a forced reset of all user PINs and increased server-side rate limiting.

Technical Deep-Dive

The attack chain exploits two independent but equally severe API misconfigurations.

1. User Enumeration via Phone Number Probing

The app's user registration/validation endpoint failed to implement standard hardening. An attacker could send a high volume of requests with different phone numbers. The server's response would differ subtly (e.g., HTTP status code, error message, response time) for a number that existed in the database versus one that did not. This allowed for automated, mass-scale harvesting of registered user identities.

[Attacker] -> [Send guess: 555-0100] -> [Freedom Chat API]
[Freedom Chat API] -> [Response: "User not found"] (Status 404)
[Attacker] -> [Send guess: 555-0101] -> [Freedom Chat API]
[Freedom Chat API] -> [Response: "Invalid password"] (Status 401) -> **CONFIRMED USER**

2. PIN Code Leakage in Channel Subscription Response The app's logic for handling user joins to public channels was fatally flawed. Upon subscribing to a channel (including the default channel all users join), the backend would query for user data. Instead of returning only necessary, non-sensitive metadata, the SQL query or subsequent data serialization mistakenly included the `user.pin` field for all users in the channel. This data was then serialized into the API response (likely JSON) and sent to the client.

// Example of flawed API response (defanged):
{
  "channel": "general",
  "users": [
    { "id": 123, "pin": "2580" },
    { "id": 456, "pin": "1234" }
  ]
}

Indicators of Compromise (IOCs)

Type	Value	Source
Tactic	User Phone Number Enumeration	TechCrunch Report
Tactic	PIN Code Exposure in Network Traffic	TechCrunch Report
Behavior	High-volume POST requests to `/api/v1/validateUser` or similar	Inferred Attack Pattern
Behavior	TLS inspection revealing PIN codes in channel join responses	Inferred Attack Pattern

MITRE ATT&CK Mapping

TA0011: Initial Access - Not directly applicable.
TA0043: Reconnaissance (T1589.001): Gather Victim Identity Information (Email Addresses, Phone Numbers) via the phone number enumeration flaw.
TA0009: Collection (T1539): Steal Web Session Cookie - The harvested PIN could be used to access the app session on a stolen device.
TA0006: Credential Access (T1111): Two-Factor Authentication Interception - A device PIN acts as a local second factor.

Detection & Hunting

SIEM/NDR Hunting Queries:

Look for anomalous volumes of requests from a single source to a user validation endpoint: `dest_port=443 AND http_method=POST AND uri_path contains "validate" AND request_count > 1000 per hour`.
Detect potential interception: Alert on outbound network traffic from mobile devices containing structured data fields like `"pin":` in plaintext over HTTPS.

Endpoint/Mobile Detection:

YARA for Network Capture Analysis: Hunt for packet capture files containing the vulnerable app's traffic.

    rule FreedomChat_PIN_Leak {
        meta:
            description = "Detects JSON structures in traffic that may contain leaked Freedom Chat PINs"
            author = "SecureBlink TI"
        strings:
            $json_pin_field = /"pin"\s*:\s*"\\d{4}"/
        condition:
            $json_pin_field
    }

Mobile security tools should flag the Freedom Chat app (versions prior to the Dec 2025 update) for making suspiciously verbose API calls that return excessive user data.

Mitigation & Remediation

Immediate Actions (For Freedom Chat Users):

Update the App: Ensure Freedom Chat is updated to the latest version available on the official app store as of December 11, 2025.
Change PIN: The vendor has reset PINs. Users should set a new, strong app-locking PIN that is not used elsewhere.
Assume Phone Number is Exposed: Affected users should be aware that their number may have been enumerated and be vigilant for targeted phishing (smishing).

Strategic Recommendations (For App Developers):

Implement a VDP: Establish a public Security Policy and Vulnerability Disclosure Program to receive reports ethically.
Harden APIs: Enforce strict rate limiting on all authentication-adjacent endpoints. Use identical, generic error messages for failed logins and invalid users.
Apply Principle of Least Privilege: Backend API responses must be rigorously filtered. Never return sensitive fields (`pin`, `password_hash`, `tokens`) in bulk user queries. Use distinct Data Transfer Objects (DTOs).
Conduct Security Architecture Review: Audit all API endpoints for information leakage, enumeration, and access control flaws.

Business Impact & Risk Assessment

This incident represents a High severity risk to user privacy and security. The direct impact includes loss of anonymity (phone number exposure) and a significant reduction in device security (PIN exposure). For the vendor, the impact is critical reputational damage, especially for an app marketed on "security" and "privacy."

The lack of a public disclosure channel forced researchers to use the media, creating adversarial publicity and delaying the fix timeline. This failure in security governance is a major red flag for potential users and enterprise evaluators.

While no CVE was assigned in the initial report, the CVSS v3.1 base score for the PIN leakage flaw is estimated as 7.5 (High) - AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The phone number enumeration flaw scores an estimated 5.3 (Medium) - AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Critical Flaws in Freedom Chat App Exposed User Identifiers & PINs

Related threat feeds

Hackers Turned ‘404 Not Found’ Into a Kurdish Protest on Army Sites