SpiceJet Online Booking System Passenger Name Record Enumeration Vulnerability

A vulnerability in SpiceJet's booking API allows unauthenticated users to access passenger name records (PNRs) without any access controls. PNR identifiers, following a predictable pattern, could be systematically enumerated to obtain associated passenger names. This issue arises from the absence of authorization checks on an endpoint meant for authenticated profile access.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of passenger information, including names associated with PNRs.