CVE-2020-25900 Information disclosure in HelloTalk
HelloTalk mobile app leaks precise GPS coordinates to other users' databases, exposing location data despite user intent to share only coarse location.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-25900?
CVE-2020-25900 is a medium-severity vulnerability in HelloTalk, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HelloTalk through 3.4.1 stores full-precision GPS coordinates even when the user had intended to share only a country or city. Furthermore, these coordinates are placed into a database on the client of other users. (The client side was changed in 2019 to encrypt that database.)
Weakness: CWE-359
Which versions are affected by CVE-2020-25900?
How do I fix CVE-2020-25900?
No fix has been published for CVE-2020-25900 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-25900 being exploited?
There is no known exploitation of CVE-2020-25900 in the wild and no public exploit code.
Sources
Also known as GHSA-2mff-7363-rvf5.