Lovense has lastly fastened its account takeover downside

Lovense is well-known for its number of remote-controlled vibrators. It’s barely much less identified for a large safety difficulty that uncovered person emails and allowed accounts to be wholly taken over by a hacker with out even needing a password. Happily, each points have been fastened, however it didn’t occur with out some drama. 

As the story goes, safety researcher BobDaHacker (with some assist) unintentionally discovered that you would uncover a person’s electronic mail deal with fairly simply by muting somebody within the app. From there, they had been ready to determine that you would do that with any person account, successfully exposing each Lovense person’s electronic mail with out a lot effort. 

With the e-mail in hand, it was then potential to generate a legitimate gtoken with no password, giving a hacker whole entry to an individual’s Lovense account with no password obligatory. The researchers instructed Lovense of the problem in late March and had been instructed that fixes had been incoming. 

In June 2025, Lovense instructed the researchers that the repair would take 14 months to implement as a result of it didn’t need to pressure legacy customers to improve the app. Partial fixes had been applied over time, solely partially fixing the issues. On July 28, the researchers posted an replace displaying that Lovense was nonetheless leaking emails and had uncovered over 11 million person accounts. 

“We may have simply harvested emails from any public username checklist,” BobDaHacker mentioned in a weblog put up. “That is particularly unhealthy for cam fashions who share their usernames publicly however clearly don’t need their private emails uncovered.”

It was round then that the information began making its manner round the information cycle. Different researchers started reaching out to point out that the exploit had really been identified way back to 2022, and Lovense had closed the problem with out issuing a repair. After two extra days within the information cycle, the intercourse toy firm lastly rolled out fixes for each exploits on July 30. 

It’s not Lovense’s first roll within the mud. In 2017, the corporate was caught with its proverbial pants down after its app was proven to be recording customers whereas they had been utilizing the app and toy. Lovense fastened that difficulty as nicely, stating that the audio knowledge was by no means despatched to their servers.