CVE-2025-45156 Details
Description
Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users.
A vulnerability exists in the Splashin iOS application version 2.0, allowing free-tier users to bypass server-side restrictions on location update intervals. While the app is designed to provide location updates every 10 minutes for free users, this limitation can be circumvented through direct API calls, enabling real-time location tracking. This issue arises because the backend fails to properly validate subscription levels before processing location update requests, leaving free users with the same tracking capabilities as premium subscribers.
To address this vulnerability, server-side subscription validation should be implemented on the affected API endpoint. This involves checking the user's subscription level before processing location update requests and enforcing the correct update intervals for free users.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 18, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://carterlasalle.github.io/splashin-cve-2025/splashin-1.pdf | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| splashin splashin | 2.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2025 | Initial Analysis | [email protected] |
| Jul 18, 2025 | CVE Modified | CISA-ADP |
| Jul 18, 2025 | New CVE Received | [email protected] |