# Vulnerability in Bumble dating app reveals any user's exact location

Bumble floored exact distances server-side, so finding distance-flip points via spoofed locations enabled precise trilateration of any matched user's exact location.

- Payout: $2,000
- Severity: high
- Program: Bumble
- Credited: Robert Heaton
- Disclosed: 2021-08-25
- Write-up quality: 8/10
- Original: https://robertheaton.com/bumble-vulnerability/
- Library page: https://bugbountylibrary.com/r/blog%3Arobertheaton-com-bumble-vulnerability
- Tags: domain:web domain:web3 impact:data-leak impact:pii-leak kind:bounty platform:blog sev:high technique:js-analysis technique:source-review vuln:access-control vuln:business-logic vuln:info-disclosure

**Target:** Bumble web API (mwebapi.phtml) location/distance endpoints
**Root cause:** Server computed exact distance between users then floored it to whole miles, leaking the exact radius at each integer flip point; combined with attacker-controlled location spoofing this yields precise distances for trilateration.
**Steps:**
1. Create attacker and victim accounts; match them to obtain victim user_id.
2. Intercept web traffic via Burp; identify POST /mwebapi.phtml?SERVER_ENCOUNTERS_VOTE and location-update requests.
3. Note edited bodies fail; find X-Pingback header signature; unminify JS, locate MD5-based signing with hard-coded key prefix.
4. Reimplement signing: `X-Pingback = md5(key + body)` to forge valid requests.
5. Spoof attacker location near victim, shuffle south in 0.01° steps querying distance until it flips from N to N+1 miles; backtrack at 0.001° to refine flip point (flip = exact N+1.0 miles since distances are floored).
6. Repeat from 3 arbitrary start locations to get 3 flip points; draw circles of radius = higher distance; intersection = victim exact location.
7. Throttle requests to avoid rate-limiting on position updates.
**How found:** Hypothesis from Tinder history: if server computes exact distance then rounds, flip points reveal exact half/whole-mile radii. Tested by spoofing locations and observing distance changes; discovered flooring (not .5 rounding) by trial, adjusted flip interpretation. Signature barrier found when edited body errored; traced X-Pingback in unminified JS, recognized MD5 constants (1732584193) via Google, found hard-coded key prefix.
**Exploitation:** Attacker with a matched account spoofs their own location repeatedly via signed API requests, queries distance to victim at each point to find integer flip boundaries, then trilaterates to recover victim's exact coordinates (demonstrated locating a target at FBI HQ).
**Escalation:** Chained a signature-forging bypass (hard-coded MD5 key in client JS) to enable arbitrary automated API requests, and a Beeline user_id leak plus missing match-queue validation to match with arbitrary users without paying.
**Insight:** When a server returns a rounded/quantized value derived from a secret continuous quantity, hunt for the quantization boundaries: binary-search the input space for flip points and invert the rounding function. Also, client-side request signing with a hard-coded key in shipped JS is forgeable—grep unminified bundles for signature header names and known hash constants.