The IT Nerd

The Cybernews research team has recently discovered that a decentralized video call app, Huddle01, was leaking real-time user logs through an exposed instance of Kafka Broker. No authentication, no encryption, or other access controls were used to protect the data, meaning that any third party could access it.

The exposed data included:

• Usernames (sometimes real names);
• Email addresses;
• Crypto wallet addresses (Huddle01 supports a wide array of wallets that operate on different blockchains (Bitcoin, Ethereum, etc.);
• Detailed activity data: which users joined specific calls, participants in each call, country, time, date, duration of the calls, etc.
• Other identifiers.

The leak was discovered on August 26th, 2025. Cybernews responsibly disclosed the data leak to the company. However, it did not respond to the initial disclosure and subsequent attempts. After one month, the exposed server remained accessible. It’s unclear how many other third parties might have accessed the data.

For more information on this, here’s the full report:

https://cybernews.com/security/video-call-app-huddle01-leaks-sensitive-user-data

This entry was posted on October 15, 2025 at 12:45 pm and is filed under Commentary with tags Cybernews. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.