Senza Keto & Fasting Android App Improper Access Control Vulnerability Allowing Account Takeover

A vulnerability has been identified in the Senza: Keto & Fasting Android App, version 2.10.15, developed by Paul Itoi. The issue arises from improper access control in user data API endpoints, which allows attackers to exploit insufficient validation checks. This exploitation can lead to the unauthorized acquisition of authentication tokens, enabling account takeover. The consequences of this vulnerability include unauthorized access to user accounts, potential privacy violations, and the possibility of misusing the platform.

Impact

Exploitation of this vulnerability could result in unauthorized access to user accounts, allowing attackers to take over accounts and misuse them on the platform.