Critical Security Flaw in AI Meeting Summarizer 'tl;dv' Exposes Live & Recorded Customer Meetings GloballyIndependent cybersecurity researcher BobDaHacker has exposed a severe security vulnerability in tl;dv (Too Long; Didn't View), a popular AI-powered meeting recording and summarization service. The flaw stems from broken access controls within the platform’s backend infrastructure, allowing authenticated users to freely query and view recorded or ongoing live meeting streams belonging to other enterprise clients without authorization.
According to the researcher’s technical analysis, the breakdown occurs during the authentication process. Upon user login, the tl;dv API generates a standard JSON Web Token (JWT). This JWT can subsequently be exchanged for a Firebase authentication token. However, rather than enforcing strict user-level or tenant-level authorization rules, the resulting token grants unrestricted read privileges across the entire client database. As a result, an attacker can query any video file stored in the system or even join real-time streams of active, ongoing video conferences.
To demonstrate the vulnerability's real-world impact, BobDaHacker successfully accessed a live video meeting held by the Ministry of Education of Malaysia, which had been joined by a meeting participant utilizing the tl;dv AI bot.
The researcher privately disclosed the flaw to tl;dv on January 28 following standard responsible disclosure practices. However, after receiving no acknowledgment or response from the company while the critical vulnerability remained actively exploitable in production, BobDaHacker chose to publicly release the findings to warn affected organizations.
Faulty Firebase rules can easily lead to enterprise-wide security breaches. In modern cloud applications, most development teams configure database rules during early prototyping to allow extensive read access for authenticated users (request.auth != null). When moving to production, the failure to strictly define access rules by team or user ID allows any valid JWT token to retrieve data keys belonging to completely unrelated accounts across the platform.
Modern employees often invite external AI transcription bots to company Zoom, Google Meet, or Microsoft Teams meetings without IT approval ("Shadow AI"). Because these bots access sensitive internal conversations, financial predictions, and proprietary code review, a single AI bot service being compromised can put every company that has ever interacted with that bot at risk, even if those companies have the most advanced internal cybersecurity defenses.
When security researchers discover zero-day vulnerabilities in tools that handle sensitive government or organizational data, unresponsive security communication channels (such as unverified security@ alias emails) force researchers to publicly disclose the flaws to protect the public. Companies that build AI tools must maintain responsive security channels and clear vulnerability disclosure policies (VDPs) to address critical vulnerabilities before malicious attackers widely exploit them.
Source: BobDaHacker.com
Critical Security Flaw in AI Meeting Summarizer 'tl;dv' Exposes Live & Recorded Customer Meetings GloballyIndependent cybersecurity researcher BobDaHacker has exposed a severe security vulnerability in tl;dv (Too Long; Didn't View), a popular AI-powered meeting recording and summarization service. The flaw stems from broken access controls within the platform’s backend infrastructure, allowing authenticated users to freely query and view recorded or ongoing live meeting streams belonging to other enterprise clients without authorization.
According to the researcher’s technical analysis, the breakdown occurs during the authentication process. Upon user login, the tl;dv API generates a standard JSON Web Token (JWT). This JWT can subsequently be exchanged for a Firebase authentication token. However, rather than enforcing strict user-level or tenant-level authorization rules, the resulting token grants unrestricted read privileges across the entire client database. As a result, an attacker can query any video file stored in the system or even join real-time streams of active, ongoing video conferences.
To demonstrate the vulnerability's real-world impact, BobDaHacker successfully accessed a live video meeting held by the Ministry of Education of Malaysia, which had been joined by a meeting participant utilizing the tl;dv AI bot.
The researcher privately disclosed the flaw to tl;dv on January 28 following standard responsible disclosure practices. However, after receiving no acknowledgment or response from the company while the critical vulnerability remained actively exploitable in production, BobDaHacker chose to publicly release the findings to warn affected organizations.
Faulty Firebase rules can easily lead to enterprise-wide security breaches. In modern cloud applications, most development teams configure database rules during early prototyping to allow extensive read access for authenticated users (request.auth != null). When moving to production, the failure to strictly define access rules by team or user ID allows any valid JWT token to retrieve data keys belonging to completely unrelated accounts across the platform.
Modern employees often invite external AI transcription bots to company Zoom, Google Meet, or Microsoft Teams meetings without IT approval ("Shadow AI"). Because these bots access sensitive internal conversations, financial predictions, and proprietary code review, a single AI bot service being compromised can put every company that has ever interacted with that bot at risk, even if those companies have the most advanced internal cybersecurity defenses.
When security researchers discover zero-day vulnerabilities in tools that handle sensitive government or organizational data, unresponsive security communication channels (such as unverified security@ alias emails) force researchers to publicly disclose the flaws to protect the public. Companies that build AI tools must maintain responsive security channels and clear vulnerability disclosure policies (VDPs) to address critical vulnerabilities before malicious attackers widely exploit them.
Source: BobDaHacker.com
Comments
Post a Comment