# Bumble/Badoo: folder_id swap decrypts obfuscated user IDs

Badoo Live Stream user-list API returns decrypted numeric person_ids when folder_id is switched from 33 to 34, deanonymizing hidden/incognito visitors.

- Payout: hidden
- Severity: medium
- Program: Bumble
- Found by: jarvis0x1
- Disclosed: 2018-11-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/402410
- Library page: https://bugbountylibrary.com/r/h1%3A402410
- Tags: area:web domain:api domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium technique:param-pollution vuln:access-control vuln:info-disclosure

**Target:** bmaapi.phtml SERVER_GET_USER_LIST endpoint
**Root cause:** The user-list endpoint accepts a client-supplied folder_id; folder 34 returns raw person_id values while folder 33 returns obfuscated IDs, so the server applies no per-folder output encoding.
**Steps:**
1. Add target obfuscated ID to Following via `POST /bmaapi.phtml?SERVER_SECTION_USER_ACTION` with `server_section_user_action.action:5, folder_id:34` and `person_id:["obff5b362880e6595302863c158018b1a7168112b2b249887"]`
2. Request `POST /bmaapi.phtml?SERVER_GET_USER_LIST` with body `server_get_user_list:{folder_id:34, preferred_count:255, offset:0, user_field_filter:{projection:[200]}}`
3. Read decrypted numeric person_id from response (folder_id 33 returns obfuscated IDs, 34 returns plaintext)
4. Remove user via `SERVER_SECTION_USER_ACTION` with `action:1, folder_id:34, person_id:["606393962"]`
**How found:** Noticed the user-list request used folder_id 33 for obfuscated output and tested folder_id 34, which returned plaintext IDs.
**Exploitation:** Attacker adds any obfuscated ID (including long incognito-visitor IDs) to their Live Stream following list, queries the list with folder_id 34 to obtain the plaintext numeric user ID, then removes the entry to avoid clutter.
**Escalation:** Same technique decrypts incognito ('invisible mode') visitor IDs, which even premium accounts cannot see.
**Insight:** When an API takes a folder_id/section parameter, enumerate sibling folder IDs: different folders may apply different output encodings to the same underlying records, leaking the raw identifiers.