Vulnerabilities

The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization.

The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly.

The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices.

The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabilities.