Vulnerability: Digilocker
A critical API vulnerability in India’s digital wallet system, Digilocker, exposed personal documents of more than 38 million citizens. This app lets you store your key documents, such as driver’s license and national identity card, in digital format instead of carrying the physical documents with you. Ashish Gahlot and Mohesh Mohan have both reported this issue independently of one another.
Both the mobile and the web app of Digilocker use APIs to communicate with the backend. As it often happens with REST APIs, one can find a vulnerability by invoking them in a different sequence than the intended one.