A significant security flaw in Verizon’s Call Filter feature allowed customers to access incoming call logs of other Verizon Wireless numbers through an unsecured API. Security researcher Evan Connelly discovered this vulnerability on February 22, 2025, which Verizon subsequently fixed in mid-March, though the total exposure period remains unknown.
## The Vulnerability
The Call Filter app, which provides spam detection and call blocking capabilities, connects to an API endpoint to retrieve call history. Connelly discovered that the API failed to verify if the requesting user was authorized to access the specific phone number’s call logs.
“The endpoint requires a JWT (JSON Web Token) in the Authorization header and uses an X-Ceq-MDN header to specify which phone number’s call history to retrieve,” explained Connelly. The critical flaw was that the system never verified whether the JWT payload’s phone number matched the requested number in the X-Ceq-MDN header.
This vulnerability allowed any Call Filter user to view another Verizon customer’s incoming call history by simply changing the header value while using their own valid authentication token.
## Security Implications
This security breach posed significant risks, particularly for high-profile individuals like politicians, journalists, and law enforcement officers. “Call metadata might seem harmless, but in the wrong hands, it becomes a powerful surveillance tool,” Connelly noted. An attacker could potentially reconstruct daily routines, identify frequent contacts, and infer personal relationships.
The researcher found no evidence of rate limiting mechanisms that would prevent mass data scraping across millions of subscribers.
## Response and Concerns
The vulnerable API endpoint appeared to be hosted on a server owned by Cequint, a telecommunications technology firm specializing in caller identification services. This raised questions about how Verizon manages sensitive call data with third parties.
Verizon confirmed the vulnerability was patched in mid-March and stated: “While there was no indication that the flaw was exploited, the issue was resolved and only impacted iOS devices. Verizon appreciates the responsible disclosure of the finding by the researcher and takes security very seriously.”