The bug is now fixed, thanks to @wasbou reporting the issue. @troyhunt and @scott_helme also verified the bug. “This is one of the most basic account takeover techniques I’ve seen." Any who knew where to look could've hijacked a Grindr account in seconds.https://t.co/BeFrrLRN8Z

— Zack Whittaker (@zackwhittaker) October 2, 2020

This vulnerability was definitely a critical issue. Concerning a company the size of Grindr could have such a flaw. https://t.co/0PtHFdRvW8

— Sean Wright (@SeanWrightSec) October 2, 2020

It’s literally copy-paste. “This is one of the most basic account takeover techniques I've seen.” More details on the Grindr vuln by @troyhunt: https://t.co/8PyBH2SOhA

— kyrah (@kyrah) October 3, 2020

So this is bad. https://t.co/zoommh3pYb

— Eva (@evacide) October 2, 2020

Whist we try not to 'over-egg the pudding' in these matters, this was a trivial attack to hack into and fully takeover *any* Grindr account you wanted, it's pretty bad: https://t.co/jp77PqZly2 @troyhunt @wasbou

— Scott Helme (@Scott_Helme) October 2, 2020

New: A major security vulnerability in dating app Grindr allowed anyone with a user's email address to reset their password, hijack their account, and access their private data.https://t.co/yZPgKkF2FU

— Zack Whittaker (@zackwhittaker) October 2, 2020

lol hard to believe this wasn't intentionalhttps://t.co/SmuTYWefp1

— Paul Gold ? (@RealOldPaul) October 3, 2020

apologies to everyone who received my unsolicited nudes during this security breach https://t.co/hdDpyg3Vy0

— Shon (@shonwashed) October 3, 2020

Here's how it worked: A user resets their password, and the password reset token is sent as a clickable link to the user's email. But the token was also leaked to the browser, making it very easy for an attacker to create their own password reset link.

➡️ https://t.co/mupvYuZDSh pic.twitter.com/xlvSKQUFQv

— Zack Whittaker (@zackwhittaker) October 2, 2020

“Grindr has fixed a security vulnerability that allowed anyone to hijack and take control of any user’s account using only their email address.” I wonder how such basic flaws ever make it into prod? https://t.co/XZpOVNEz6j

— kyrah (@kyrah) October 3, 2020

So here's the @Grindr story and how a simple vulnerability found by @wasbou made it trivial to takeover @Scott_Helme's account by copying and pasting a token out of the password reset response page: https://t.co/HCE6O1Vltf

— Troy Hunt (@troyhunt) October 2, 2020

Just blogged: Hacking Grindr Accounts with Copy and Paste https://t.co/IconP1ndsd

— Troy Hunt (@troyhunt) October 2, 2020

lol hard to believe this wasn't intentionalhttps://t.co/SmuTYWefp1

— Paul Gold ? (@RealOldPaul) October 3, 2020

Whist we try not to 'over-egg the pudding' in these matters, this was a trivial attack to hack into and fully takeover *any* Grindr account you wanted, it's pretty bad: https://t.co/jp77PqZly2 @troyhunt @wasbou

— Scott Helme (@Scott_Helme) October 2, 2020

A security flaw in #Grindr let anyone easily hijack user accounts.
? https://t.co/EYULylCbi5#Infosec #CyberSecurity #CISO #InfoSecurity #socialMedia #DataBreach #DataPrivacy pic.twitter.com/7hwXySWRzD

— Stéphane Nappo (@StephaneNappo) October 2, 2020

.@Grindr fixed a bug allowing full takeover of any user account
By @BleepinComputer https://t.co/M2jLj8So3v#CyberSecurity #Infosec #technology
Cc: @archonsec @todddlyle @PVynckier @fogle_shane @AudreyDesisto @Victoryabro @BillMew @CioAmaro @Corix_JC @_SChmielewski @RagusoSergio pic.twitter.com/jqoRkxnKy1

— Fabrizio Bustamante (@Fabriziobustama) October 3, 2020

Grindr fixed a bug allowing full takeover of any user account https://t.co/fNJ3qoyFvc

— Nicolas Krassas (@Dinosn) October 3, 2020

Hacking Grindr Accounts with Copy and Paste https://t.co/mZEArqBgh8

— /r/netsec (@_r_netsec) October 3, 2020

@troyhunt THIS is the best post!!! Have to thank you for making me laugh in 2020, while helping to keep people online safe.

Hat tip ? Wassime BOUIMADAGHENE and Scott Helme @Scott_Helme.https://t.co/RdMkd0BFJT

— Carlos Court (@LeButcha) October 3, 2020

Fuck this is dreadful. I mean, fine, Grindr did the right thing *once* the tweet got some attention (and good for them for raising a bounty programme afterwards) but still... how did not even the most basic developer see this flaw?https://t.co/qoDyKTE0R8

— Chris Ward :: #BlackLivesMatter #TransLivesMatter (@christopherward) October 3, 2020

Grindr has fixed a security vulnerability that allowed anyone to hijack and take control of any user’s account using only their email address.
https://t.co/E4veExYAij

— Adam Levin (@Adam_K_Levin) October 3, 2020