Verizon API Flaw Exposed User Call Logs

A serious security vulnerability in Verizon’s Call Filter app allowed users to access the incoming call logs of any other Verizon customer by modifying an API request. The issue, discovered by cybersecurity researcher Evan Connelly, was disclosed to Verizon in February 2025 and patched by mid-March. Verizon confirmed the issue in a statement to BleepingComputer, adding that the vulnerability “only impacted iOS devices” and there was “no indication that the flaw was exploited.”

The bug was rooted in an API used by the Call Filter app, a spam-blocking tool pre-installed on most Verizon phones. According to Connelly, the app connected to an endpoint that accepted a user’s phone number in the request header without verifying it against the JWT token used for authentication. This made it possible for anyone with technical know-how to retrieve another user’s call history simply by swapping in a different phone number.

While the flaw did not expose call content or messages, metadata such as timestamps and contact patterns still pose significant privacy risks, particularly for high-risk individuals like journalists or law enforcement personnel. While seeing someone’s call logs might not seem like it would offer much information at first, Connelly emphasized it could be “a powerful surveillance tool” in the wrong hands.

“With unrestricted access to another user's call history, an attacker could reconstruct daily routines, identify frequent contacts, and infer personal relationships,” Connelly explained.

The API was hosted by Cequint, a third-party telecom vendor specializing in caller ID tech, raising further concerns about how Verizon handles customer data via external providers. No passwords, no permissions — just a number, and a little know-how were enough to exploit the flaw.

The incident also follows alarming cybersecurity trends highlighted in Verizon’s own 2024 Data Breach Investigations Report. As we reported earlier last year, vulnerability exploitation had surged 180% in a single year, with human error playing a role in 68% of breaches.