Edison Mail vulnerability allowing unauthorized access to email accounts of other users

mood · May 16, 2020

Edison Mail vulnerability allowing unauthorized access to email accounts of other users
May 16, 2020
https://9to5mac.com/2020/05/16/edison-mail-unauthorized-access/

Update: Edison Mail provided the following statement to 9to5Mac, adding that the bug only affects iOS users.

“10 hours ago a software update was rolled out to a small percentage of our iOS users. Some of these users who received the update are experiencing a flaw in the app impacting email accounts that was brought to our attention this morning.
Click to expand...

Edison Mail is one of the more popular third-party email applications for iPhone, iPad, and Mac, but an apparent bug in the service is raising major privacy concerns. Edison Mail users report that after enabling a new account syncing feature in the app, they have full access to email accounts of other Edison Mail users.

Zach Knox was one of the first Edison Mail users to acknowledge the problem on Twitter this morning: [...]
Another user, Petter, says that they can see that another iPhone has unauthorized access to their account [...]

It’s impossible to know the scale of this problem at this point, but even if it’s not affecting all Edison users, it’s a major security vulnerability for those who are affected.
Click to expand...

mood · May 18, 2020

Over 6,400 Edison Mail Users Hit by Security Bug in iOS App
The company acted quickly to resolve the issue, but thousands may have been impacted
May 18, 2020
https://www.securityweek.com/over-6400-edison-mail-users-hit-security-bug-ios-app

Several users reported over the weekend that they could access other people’s email accounts from the iOS app without the need to provide credentials.

Edison Mail said the incident potentially impacted 6,480 users of the iOS application. The company reassured customers that credentials were not compromised.
The first patch was released on Saturday morning, but this fix prevented impacted users from accessing any account from the Edison app. Another update was released on Sunday morning, which re-enabled access for affected users.

“We have notified all individual users who may have been impacted by this issue via email, and as an additional safety precaution, suggested that impacted users also change their email account password. If you did not receive an email on this issue then your account was not impacted,” the company said in a post published on Medium on Monday.
Click to expand...

Log in or Sign up

Edison Mail vulnerability allowing unauthorized access to email accounts of other users

mood Updates Team

mood Updates Team

Log in or Sign up

Edison Mail vulnerability allowing unauthorized access to email accounts of other users

mood Updates Team

mood Updates Team

Useful Searches