2025 Suno — JWT leakage, IDOR, DoS vulnerabilities

2025 Unknown records affected

Data compromised

JWT tokens; PII; OAuth details

Technical writeup

Multiple high-severity: JWT tokens leaked via API; IDOR allowed unauthorized access to private user data; DoS via unrestricted resource consumption. Public disclosure after vendor failed secure coordination.

Root cause

Broken authentication; IDOR; misconfiguration

References

https://seclists.org/fulldisclosure/2025/Oct/8
https://github.com/theelderemo/suno-security-disclosure