Vienna researchers identify 3.5 billion WhatsApp accounts via Contact Discovery flaw
Researchers from the University of Vienna and SBA Research discovered a vulnerability in WhatsApp's Contact Discovery mechanism that allowed them to query over 100 million phone numbers per hour and identify 3.5 billion active accounts worldwide. The flaw lacked rate limiting and enabled large-scale enumeration of users and extraction of metadata including encryption keys, account age, and operating system information. WhatsApp and Meta patched the vulnerability after the researchers disclosed it.
What happened
Researchers from the University of Vienna and SBA Research discovered a security vulnerability in WhatsApp's Contact Discovery mechanism that allowed them to enumerate user accounts at scale. The researchers were able to query over 100 million phone numbers per hour against WhatsApp's server without rate limiting, ultimately identifying more than 3.5 billion active WhatsApp accounts worldwide.
The Contact Discovery mechanism normally allows users to see which contacts have WhatsApp accounts by synchronizing their phone's address book with Meta's servers. The researchers demonstrated how this mechanism could be abused for large-scale user enumeration by making unlimited requests to the server from a single source.
Reported impact
The researchers extracted phone numbers, public encryption keys, timestamps, profile pictures, and status text from the exposed accounts. They also derived additional metadata that revealed users' operating systems, account age, and the number of connected secondary devices such as WhatsApp Web installations.
The research identified millions of active WhatsApp accounts in countries where the platform is officially banned, including China, Iran, and Myanmar. The researchers found that nearly half of the phone numbers from the 2021 Facebook data breach remained active on WhatsApp.
Index analysis
The vulnerability existed in WhatsApp's server-side controls, which did not implement adequate rate limiting or other protections against automated enumeration of the entire user database. The lack of restrictions allowed a single actor to query the full scope of WhatsApp's active user base.
Governance controls
WhatsApp and Meta addressed the vulnerability in cooperation with the research team and closed the gap following disclosure.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.