2026 Neon (Call Recording) — Critical flaw, cross-user data access
Data compromised
Phone numbers; audio recordings; call transcripts
Technical writeup
Viral iOS call-recording app. Critical flaw: any logged-in user could access phone numbers, audio recordings, transcripts of other users. TechCrunch found via Burp Suite; back-end left recordings/transcripts exposed; audio links publicly accessible. 75k downloads in one day; top 5 free iPhone apps. App paid users $0.30/min for anonymized call data to AI firms. Founder took app offline; removed from App Store/Play Store.
Root cause
Missing authorization; exposed back-end; publicly accessible audio links