BaseChat Android app 9.8.1 has three vulnerabilities exposing user data

Flaws in the Android edition of BaseChat – Audio Dating App, version 9.8.1, can ultimately undermine the privacy of users' personal data and activity.

BaseChat is an online dating platform built with Flutter for users over 18, enabling anonymous, voice-first exchanges between members. Three separate vulnerabilities reside in the shipped Android application. The first, tracked as VU#124705.1, is a fail-open flaw in TLS server certificate validation for connections to the backend API host, where any self-signed certificate can bypass standard TLS security checks.

VU#124705.2 involves paid user accounts being mapped to a third-party RevenueCat subscriber database using raw MSISDNs, which are guessable public identifiers. The RevenueCat Software Development Kit includes a public API key inside the application's Android Package Kit, so an attacker can query the RevenueCat API with predictable identifiers to retrieve individual user metadata.

VU#124705.3 concerns Personally Identifiable Information (PII) written to Android system logs in the production build. During voice calls, unstripped debug statements record the remote party's MSISDN, which allows an attacker to recover phone numbers of callers meant to remain anonymous.

Impacts vary by vulnerability. A network-positioned attacker may intercept and alter API traffic, potentially resulting in account takeover through theft of session credentials. Using arbitrary phone numbers, an attacker holding the public RevenueCat SDK key can query the RevenueCat API and obtain associated user metadata, including activity and purchase history. Personal data and PII of other users, meant to stay anonymous, can be reached through local system logs, and sending other users' MSISDNs to the client in any capacity is described as presenting a privacy violation.

The solution section states only that Mobile Trading GmbH, the owners of BaseChat, could not be reached to coordinate this vulnerability. The CVE ID field is empty. Public disclosure occurred on 2026-11-03, with first publication on the same date and the latest update at 15:42 UTC that day; this is document revision 1. Mahmoud Ali Khan is credited with reporting these vulnerabilities, and Alex Lewis wrote the document.