LY Corporation · Report #927338
LINE Profile ID leaks in OpenChat
Validstatus
highseverity
$3,000bounty
101upvotes
27 Dec 2021disclosed
Summary
Users can participate in OpenChat using a new OpenChat profile that is distinct from the LINE profile. However, when the victim attaches an image in a post in OpenChat's Note, the ID of LINE Profile was stored together in the image's metadata. From this information, it is possible to determine the LINE user profile of OpenChat participants.
Hackers were able to break anonymity in OpenChat.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.