PT-2026-46956 · Hellotalk · Hellotalk

Published 2026-06-05 · Updated 2026-06-05 · CVE-2020-25900

Mitre

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

HelloTalk through 3.4.1 stores full-precision GPS coordinates even when the user had intended to share only a country or city. Furthermore, these coordinates are placed into a database on the client of other users. (The client side was changed in 2019 to encrypt that database.)

Fix

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2020-25900

Affected Products

Hellotalk

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2020-25900 · Security Note
• https://isopach.dev/CVE-2020-25900 · Note