Exposed and Ignored: Lovense Zero-Day Flaw Risks 20 Million Users' Privacy

The Intimate Tech Problem Nobody Saw Coming

In a world where connected devices dominate personal lives, sex tech has quietly become one of the most sensitive intersections of pleasure and privacy. Lovense, a popular brand known for its app-controlled sex toys used by millions globally, is now at the center of a disturbing cybersecurity scandal. A severe vulnerability, still unpatched, allows attackers to extract users’ email addresses from their publicly known usernames. This isn’t just a minor bug — it opens the door to doxxing, harassment, and even full account takeovers, including administrative access on the platform.

Discovered by cybersecurity researcher BobDaHacker and his team, the flaw highlights a chilling truth: even companies in the most intimate corners of tech can neglect basic security principles. The flaw was first disclosed in March 2025, and while one critical issue was eventually addressed, the most dangerous exposure — leaking user emails — remains unresolved as of July. Despite public promises, Lovense has yet to roll out a working fix, claiming backward compatibility concerns. With user safety hanging in the balance and the vulnerability being easily exploitable at scale, trust in Lovense’s data protection policies is rapidly crumbling.

Widespread Flaw Endangers Lovense’s Global User Base

Lovense, the maker of interactive sex toys such as Lush, Gush, and Kraken, faces a massive privacy issue due to an unpatched zero-day vulnerability. This bug allows attackers to obtain the registered email address of any user, merely by knowing their username — a detail often shared openly by cam models and users on forums. The flaw was identified by BobDaHacker, along with researchers Eva and Rebane, who reverse-engineered the Lovense app and demonstrated how easily the email exposure could be automated. The exploit hinges on how Lovense’s XMPP-based chat system handles encrypted user data. Using simple API requests and encryption keys, attackers can trigger server responses that indirectly reveal a user’s actual email address. The resulting data, pulled from the platform’s backend, can be exploited in under a second using custom scripts.

Worse yet, the platform’s usernames are widely available on forums and sites like LovenseLife, and can even be harvested using tools like Lovense’s own FanBerry extension. This has made large-scale attacks and email scraping viable for malicious actors. Another critical flaw found during the investigation allowed account hijacking with only an email — no password required. This second vulnerability extended to admin-level accounts on platforms like StreamMaster and Cam101. While Lovense eventually fixed the account hijacking issue, it delayed the email vulnerability fix due to concerns over breaking legacy app support. The researchers expressed frustration with the company’s misleading communications, as Lovense repeatedly claimed the issues were resolved when they were not. Even after pushing a proxy-based fix in July, the researchers confirmed the flaw still existed. This incident echoes similar breaches reported back in 2016, suggesting a systemic failure in Lovense’s approach to user data security. Despite collecting over \$3,000 in bug bounties, the researchers insist that Lovense has not taken the matter seriously enough. As of now, the company claims it will need up to 14 months to fully fix the vulnerability, leaving millions exposed in the meantime.

What Undercode Say:

A Tech-Savvy Nightmare in the Most Vulnerable Space

This case is a disturbing example of how even well-known, consumer-facing tech brands can fail to uphold basic cybersecurity standards — particularly when the stakes are as high as personal intimacy. Lovense operates in an industry where privacy is non-negotiable. Any breach not only compromises data, but dignity, safety, and even livelihoods for sex workers and cam models who depend on pseudonymity.

The zero-day vulnerability exposed here is a classic case of failure to isolate user identifiers from sensitive information. Email addresses should never be derivable from usernames, especially on platforms where anonymity is a key selling point. By designing their backend architecture to build Jabber IDs (JIDs) that include real user emails, Lovense introduced a fundamental privacy flaw. The fact that the entire process can be executed in under a second per user through automation makes the issue even more urgent.

The company’s handling of the situation raises multiple red flags. First, the delay in addressing a flaw reported back in March suggests sluggish incident response. Then there’s the contradiction between what Lovense says publicly and what security researchers are still able to replicate — even after supposed patches were deployed. Worse yet, prioritizing backward compatibility over user safety reveals a troubling set of internal priorities. When the trade-off is between legacy support and exposing 20 million users, the correct answer is obvious.

Lovense’s use of XMPP for user-to-user communication may have seemed like a cost-effective and extensible solution. However, the protocol’s open-ended structure is not well-suited to securely handle personally identifiable information without significant customization. The company’s implementation clearly lacked such foresight, and now users are paying the price.

Moreover, the company’s refusal to immediately force app updates or invalidate vulnerable endpoints suggests it is trying to avoid friction with its existing user base at the cost of long-term trust. Lovense’s statement about needing 14 months to fully resolve the issue through a “stable, user-friendly” plan sounds more like corporate spin than security strategy.

There’s also an ecosystem risk here. Lovense toys are integrated with third-party platforms and services — from streaming sites to tip-based cam interfaces. A single compromised Lovense account could provide entry into broader platforms or even payment processing profiles. If this vulnerability is ever weaponized at scale, it could create ripple effects across the entire adult content tech industry.

On a broader note, this incident reinforces the need for industry-wide regulations in sex tech. Companies operating in this sensitive niche should be held to stricter data handling and encryption standards, just as fintech or healthcare providers are. Without clear regulatory guidance, we’re relying on the goodwill of companies whose incentives often prioritize feature rollouts over robust security.

The security researchers deserve recognition for their responsible disclosure. Despite receiving minimal compensation and facing dismissive responses, they persisted in pushing Lovense toward accountability. Unfortunately, the public remains in the dark as long as Lovense refuses to be transparent about how many users have been affected or how widely the exploit may have already been used.

For now, users should avoid exposing usernames in public forums and reconsider using the Lovense platform until credible fixes are in place. Trust in this company’s ability to protect user data has been fundamentally undermined — and it’s going to take more than empty PR statements to fix it.

🔍 Fact Checker Results:

✅ Vulnerability was responsibly disclosed by security researchers in March 2025
❌ Lovense did not fully patch the email exposure issue as of July 2025
✅ Attack can be executed without user interaction and takes under one second

📊 Prediction:

Unless Lovense deploys a universal fix and forces legacy users to update, this vulnerability will remain exploitable well into 2026. We also expect copycat attacks or leaks to emerge in underground forums if usernames continue to circulate openly. Regulatory scrutiny may increase, and Lovense could face legal action if users experience harm due to the delayed patch rollout.