VU#124705: BaseChat · Audio Dating App, Android version 9.8.1, contains multiple vulnerabilities
Source CERT/CC
Rated High by Threat Radar's AI analysis
Data as of 3 Nov 2026, 18:30 UTC
What to do
AI-suggested
Users and administrators should consider discontinuing use of BaseChat version 9.8.1 on Android until a patched version is released. Avoid using the app on untrusted networks to reduce risk of interception. Monitor for any future vendor advisories or updates addressing these vulnerabilities.
Description
Multiple vulnerabilities have been identified in BaseChat – Audio Dating App, Android version 9.8.1, compromising user privacy and security. The app fails to properly validate TLS server certificates, allowing any self-signed certificate to bypass security checks. Paid user accounts are linked to a third-party RevenueCat subscriber database using raw phone numbers, which can be queried via a public API key embedded in the app. Additionally, the app logs personally identifiable information, including phone numbers of callers, to Android system logs, exposing private data. These issues enable interception and modification of API communication, unauthorized access to user metadata, and leakage of private phone numbers through logs. The vendor has not responded to coordinate remediation.