Security researcher Sanjana Sarda at Independent Security Evaluators tested Bumble’s API in 2020. Bumble has over 100 million users and a paid premium tier called “Bumble Boost.”

By intercepting the app’s API traffic with a proxy, Sarda found that the API checked for a valid session token on every request but did not verify whether the calling user’s subscription or role authorized them to use specific functions.

What a free account could do by calling the API directly:

• See who swiped right on them (a core Bumble Boost feature)

• Extend expired matches (another paid feature)

• Re-match with previously unmatched connections (paid feature)

• Access certain administrative API functions not exposed in the regular UI

Sarda reported the findings to Bumble in June 2020. Bumble acknowledged the report but was slow to remediate. ISE published their findings publicly in November 2020 after waiting over five months.