Mobile App Wall Of Shame: Shaadi.com

The report documents a serious security flaw in the Shaadi.com mobile applications (iOS and Android) where user credentials (username/password) and other registration data are sent in cleartext over HTTP during account registration and login. The finding is confirmed on specific app versions (iOS v4.2.1 and Android v4.2.2/4.1.3) and includes request/response captures showing POST/GET traffic containing plaintext credentials, which could allow attackers on the network to intercept credentials and compromise user accounts and personal data.