Security researcher Jan Masters discovered that Peloton's API endpoint /api/user/{userId}/workout_list returned private user data with no authentication required at all — not even a valid login.
By simply changing the userId in the URL, anyone could retrieve any Peloton user's: age, gender, city, weight, workout history, and fitness statistics.
Masters reported the vulnerability to Peloton in January 2021. Peloton acknowledged it — then took three months to fix it, only after TechCrunch published the story.
Weight. Fitness level. City. Workout habits. For 4 million people. Someone's health data is deeply personal. It can affect their insurance, their employment, their relationships. They had no idea it was sitting in the open.
Two failures layered on top of each other: no authentication check at all, and no object-level authorization. The endpoint was wide open. Any HTTP request with a userId returned data. No token, no session, nothing.