https://www.bleepingcomputer.com/news/security/verizon-call-filter-api-flaw-exposed-customers-incoming-call-history/
A vulnerability in Verizon’s Call Filter feature allowed customers to access the incoming call logs for another Verizon Wireless number through an unsecured API request. The flaw was discovered by security researcher Evan Connelly on February 22, 2025, and was fixed by Verizon sometime in the following month. However, the total period of exposure is unknown. Verizon’s Call Filter app is a free utility that offers users spam detection and automatic call blocking. A paid version (Plus) adds a spam lookup and risk meter, the ability to apply blocks by type of caller, and receive caller ID on unknown numbers. The free version of the app comes pre-installed and enabled by default on eligible Android and iOS devices bought directly from Verizon, and is believed to be used on millions of devices. … When using the Call Filter app, Connelly discovered that the app would connect to an API endpoint, https://clr-aqx.cequintvzwecid.com/clr/callLogRetrieval, to retrieve the logged-in user’s incoming call history and display it in the app. … However, the researcher discovered that the phone number in the JWT payload for the logged-in user was not verified against the phone number whose incoming call logs were being requested. …
Regards