Low PNR Entropy: I accessed all airline bookings via simple math(alexschapiro.com)

4 pointsby bearsyankees7 mesi fa1 comments

Low PNR Entropy: I accessed all airline bookings via simple math

https://alexschapiro.com/blog/security/vulnerability/2025/11/20/avelo-airline-reservation-api-vulnerability

1 comments

Meanwhile in India we have airlines asking for OTP + Aadhaar + blood sample to change a seat, and somehow Avelo just needed 6 random chars. Beautiful write-up, Alex — this is the kind of responsible disclosure we need more of.