Grindr: Security flaw let anyone take over user accounts

In 2020 a flaw in Grindr's password reset let anyone who knew a user's email address take over the account, including messages, photos and HIV status fields.

What happened

In October 2020 an independent security researcher found that Grindr's password reset page sent the secret reset token back to the browser. With that token, anyone who knew a user's email address could build a reset link, set a new password and log into the account. A second researcher tested the flaw and confirmed it with a test account. TechCrunch reported that the data within reach included photos, messages, sexual orientation, HIV status and last test date. Grindr fixed the flaw shortly after it was made public. The company said it believed the issue was addressed before any malicious party used it.

What is documented

• TechCrunch reported the flaw, confirmed that it had been fixed, and published Grindr's statement.
• The verifying researcher described in his own write-up how he took over a test account, and that the issue was fixed.

What has not been established

• Whether anyone used the flaw before the fix. Grindr says no; this has not been independently confirmed.
• No regulator decision about this incident has been found.

What this means for you

1. Turn on any extra login protection the app offers, and use an email address others don't know.
2. Think about what sensitive information, such as health status, you store in a dating profile.
3. If you get a password reset email you did not ask for, change your password right away.