A leftover trip endpoint returned another rider's driver details
Dead endpoints are still an authorization boundary. The useful test is two accounts you own: one trip you belong to, and one you do not. A hardcoded path in a mobile client is the clue, not the finding.
- Original severity
- Medium (5.3) source-reported; not rescored by vulns.co
- Public source
- hackerone disclosure
- Program / vendor
- Bykea
- Product / surface
- A hardcoded legacy API still reachable from the mobile client
- Weakness
- Insecure direct object reference · CWE-639
- Affected boundary
- An authenticated user and another user's trip
- Disclosure date
- 2025-06-13
- Public status checked
- 2026-09-26
- Public attribution
- bugbountywithmarco
What the evidence established
The public summary says a retired endpoint stayed callable and returned driver details for trips the caller did not own. The program marked it resolved.
Why the impact was credible
The source reported disclosure of another trip's driver details to a caller who was not a participant.
Durable engineering lesson
Dead endpoints are still an authorization boundary. The useful test is two accounts you own: one trip you belong to, and one you do not. A hardcoded path in a mobile client is the clue, not the finding.
Control pattern
Retire unused routes, and check trip membership on every object read that remains.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-26.