The related intercourse toy platform Lovense is susceptible to a zero-day flaw that permits an attacker to get entry to a member’s electronic mail deal with just by understanding their username, placing them susceptible to doxxing and harassment.
Lovense is an interactive intercourse toy producer, greatest identified for producing app-controlled intercourse toys with names just like the Lush, the Gush, and, maybe most boldly, the Kraken. The corporate claims to have 20 million clients worldwide.
Whereas Lovense toys are generally used for each native and long-distance leisure, they’re additionally fashionable amongst cam fashions who enable viewers to tip or subscribe for distant management of their toys.
Nevertheless, the related expertise may also expose their Lovense username, and because of this flaw, probably reveal their personal electronic mail deal with.
Lovense usernames are sometimes publicly shared on boards and social media, making them straightforward targets for attackers.
The flaw was found by security researcher BobDaHacker, who collaborated with researchers Eva and Rebane to reverse engineer the app and automate the assault.
The researchers disclosed two flaws over 4 months in the past, on March 26, 2025. Nevertheless, solely one of many flaws, a crucial account hijacking flaw, was subsequently fastened.
The Lovense flaws
The vulnerability stems from the interplay between Lovense’s XMPP chat system, used for communication between customers, and the platform’s backend.
“So it began once I was utilizing the Lovense app and muted somebody. That is it. Simply muted them,” explains BobDaHacker’s report.
“However then I noticed the API response and was like… wait, is that an electronic mail deal with? Why is that there? After digging deeper, I discovered tips on how to flip any username into their electronic mail deal with.”
To use the flaw, an attacker makes a POST request to the /api/put on/genGtoken API endpoint with their credentials, which returns a gtoken (authentication token) and AES-CBC encryption keys.
The attacker then takes any publicly identified Lovense username and encrypts it utilizing the retrieved encryption keys. This encrypted payload is distributed to the /app/ajaxCheckEmailOrUserIdRegisted?electronic mail={encrypted_username} API endpoint.
The server responds with knowledge containing a faux electronic mail deal with, which the researcher transformed right into a faux Jabber ID (JID) utilized by Lovense’s XMPP server.
By including this faux JID to their XMPP contact listing and sending a presence subscription over XMPP (just like a buddy request), the attacker can refresh the roster (contact listing), which now contains each the faux JID and the actual one related to the goal’s account.
Nevertheless, the issue is that the actual JID is constructed utilizing the person’s precise electronic mail, within the format username!!!area.com_w@im.lovense.com, permitting attackers to extract the sufferer’s electronic mail deal with.
For instance, if it returned bleeping!!!instance.com_w@im.lovense.com, the ensuing precise electronic mail of the Lovense account is bleeping@instance.com.
The researchers confirmed that the whole course of will be accomplished in lower than one second per person with a script. BleepingComputer created a faux account in the present day and shared our username with BobDaHacker, permitting them to easily join as a buddy and return the e-mail we registered with.
The researcher additionally said that it is not obligatory to simply accept a buddy request to take advantage of the flaw.
BleepingComputer additionally confirmed that it’s comparatively straightforward to seek out authentic usernames on boards and Lovense-related websites, like lovenselife.com.
The researcher additionally claims that the FanBerry extension, created by Lovense, can be utilized to reap usernames as lots of the cam fashions use the identical username, making wide-scale electronic mail harvesting attainable.
The researchers additionally found a crucial vulnerability that permit them utterly hijack an account.
Utilizing solely an electronic mail deal with, an attacker may generate authentication tokens without having a password. Utilizing these tokens, an attacker may impersonate a person on Lovense platforms, together with Lovense Join, StreamMaster, and Cam101.
These tokens reportedly labored on admin accounts as properly.
Whereas Lovense has mitigated this flaw by rejecting the tokens on its APIs, the researchers famous that gtokens can nonetheless be generated with out a password.
Each points had been reported to Lovense on March 26, 2025. In April, after additionally submitting the bugs on HackerOne, Lovense knowledgeable the researchers that the e-mail situation was already identified and glued in an upcoming model.
The corporate initially downplayed the account hijacking flaw, however after being informed it may enable full admin account entry, Lovense reclassified it as crucial.
In complete, the researchers obtained $3,000 for the disclosure of the issues.
On June 4, the corporate claimed the issues had been fastened, however the researchers confirmed this was not the case. Lovense in the end fastened the account hijack flaw in July however said that it could take roughly 14 months to resolve the e-mail flaw, as it could break compatibility with older variations of their app.
“We have launched a long-term remediation plan that may take roughly ten months, with at the very least 4 extra months required to completely implement an entire resolution,” Lovense informed the researcher.
“We additionally evaluated a quicker, one-month repair. Nevertheless, it could require forcing all customers to improve instantly, which might disrupt assist for legacy variations. We have determined in opposition to this strategy in favor of a extra steady and user-friendly resolution.”
The researchers criticized this response, stating the corporate repeatedly claimed the problems had been fastened after they weren’t.
“Your customers deserve higher. Cease placing outdated app assist over security. Truly sort things. And take a look at your fixes earlier than saying they work,” BobDaHacker wrote within the report.
In the end, Lovense says they deployed a proxy characteristic on July third that was instructed by the researchers to mitigate the assault. Nevertheless, even after doing a power replace of the app, the flaw was not fastened, so its unclear what was modified.
In 2016, a number of Lovense flaws uncovered electronic mail addresses or allowed attackers to find out if an electronic mail deal with had an accoune at Lovense.
BleepingComputer reached out to Lovense for remark however didn’t obtain a response.
CISOs know that getting board buy-in begins with a transparent, strategic view of how cloud security drives enterprise worth.
This free, editable board report deck helps security leaders current danger, affect, and priorities in clear enterprise phrases. Flip security updates into significant conversations and quicker decision-making within the boardroom.
