Anti-vax dating site exposed data for 3,500 users through ‘debug mode’ bug

Illustration by Carlo Cadenas / The Verge

The type of people who don't get vaccinations are not good at preventative cybersecurity.

According to a report by the Daily Dot, "Unjected", a dating site for people who are not vaccine free, failed to take basic precautions to keep users' data secure, leaving sensitive data exposed and allowing anyone to become a site administrator."

The administrator dashboard is accessible to anyone who knows how to look for it. An administrator could see user information for any member of the site, including name, date of birth, email address, and home address.

The vulnerability was confirmed by a security researcher who edited live posts on the site. A special set of features for software developers to use while working on the app should never be enabled by default in an application that has been deployed.

The researcher was able to make almost any change to the site, including adding or removing pages, offering free subscriptions for paid-tier services, or even deletion of the entire database of post backups. All of the users' data was accessible through the administrator features.

Unjected wants to build connections among the unvaccinated community. Users can offer their semen, eggs, or breastmilk for donation in the infertility section of Unjected. Users can list their location and blood type on the website in order to sign up for a blood bank. The blood bank and fertility services are used to help users find mRNA-free donors.

The Unjected website is one of the main portals for the project after the Unjected app was kicked out of the Apple App Store in August 2021. The app is still listed on the Play store, where it has more than 10k downloads and an average review of 2.5 stars.