Ullu App CVE-2025-45083: Brute-force Bypass of Parental PIN Control

Critical Vulnerability Information Vulnerability Details CVE ID: CVE-2025-45083 Status: Published Link: https://nvd.nist.gov/vuln/detail/CVE-2025-45083 Description Ullu App Android v2.0.920, iOS v2.6.0, and Ullu Web Platform are affected by an improper access control vulnerability. Attackers can bypass parental PIN protection using brute-force techniques, as there are no rate-limiting or lockout mechanisms in place for PIN inputs. Impact 1. Bypass parental controls, exposing restricted content to unauthorized users 2. Violation of content accessibility protections, particularly for minors 3. Elevation of privileges by circumventing access restrictions 4. Legal and compliance risks related to age-restricted content delivery Attack Scenario - Web 1. User navigates to https://ullu.app/ 2. Capture HTTP request triggered when entering parental PIN 3. Use automated scripts (e.g., Burp Intruder or custom Python script) to brute-force 4-digit PINs 4. Disable parental controls without triggering any anti-brute-force mechanisms Technical Details Vulnerability Type: Improper Access Control CWE Classification: CWE-284 - Improper Access Control Affected Versions: - Android App: v2.0.920 (Play Store) - iOS App: v2.6.0 (App Store) - Web Platform: https://ullu.app/ Affected Products 1. Ullu Web Platform: https://ullu.app/ 2. Ullu Android App: Google Play Link (v2.0.920) 3. Ullu iOS App: App Store Link (v2.6.0) Vendor Information Vendor: Ullu Website: https://ullu.app/ Proof of Concept (PoC) Web: 1. Intercept HTTP request triggered during parental PIN entry 2. Use script or Burp Intruder to iterate through 8000-9999 PINs 3. Parental PIN successfully cracked, restricted content becomes accessible 4. PoC Video: YouTube Link App: 1. Use proxy (e.g., Burp Suite) or local tool (e.g., Frida) 2. Identify PIN validation endpoint or local logic (via Frida) 3. Use automated input or request sending to brute-force all 4-digit PIN combinations 4. Successful PIN cracking results in unlocking adult content 5. PoC Video: YouTube Link Discoverer Ishaan Kumar

Goal Reached Thanks to every supporter — we hit 100%!

Ullu App CVE-2025-45083: Brute-force Bypass of Parental PIN Control