Verizon Call Filter API flaw exposed customers' incoming call history

A vulnerability in Verizon's Call Filter feature allowed customers to access the incoming call logs for another Verizon Wireless number through an unsecured API request. The flaw was discovered by security researcher Evan Connelly on February 22, 2025, and was fixed by Verizon sometime in the following month. However, the total period of exposure is unknown. Verizon's Call Filter app is a free utility that offers users spam detection and automatic call blocking. A paid version (Plus) adds a spam lookup and risk meter, the ability to apply blocks by type of caller, and receive caller ID on unknown numbers. The free version of the app comes pre-installed and enabled by default on eligible Android and iOS devices bought directly from Verizon, and is believed to be used on millions of devices. Connelly told BleepingComputer that he only tested the iOS app. However, he noted that the Android app was also very likely impacted by the same bug, as the issue was with the feature's API rather than the apps themselves. When using the Call Filter app, Connelly discovered that the app would connect to an API endpoint, https://clr-aqx.cequintvzwecid.com/clr/callLogRetrieval, to retrieve the logged-in user's incoming call history and display it in the app. "This endpoint requires a JWT (JSON Web Token) in the Authorization header using the Bearer scheme and uses an X-Ceq-MDN header to specify a cell phone number to retrieve call history logs for," explains Connelly. "A JWT has three parts:...