A Free Account Could Watch Every Classroom's Live Feed

The Vulnerability

The platform pushed live events to its web and app clients through a real-time messaging proxy reachable over a WebSocket on each portal. Access to that proxy required only an authenticated session, and account sign-up was open self-service with no email verification and no identity check.

The proxy's permission rules were the flaw. Every authenticated session was granted subscribe and publish rights on the entire classroom channel namespace, rather than being scoped to the specific classes that session belonged to. A session could therefore subscribe across every classroom channel at once and receive events from every classroom on the platform.

The same proxy fronted the parent, teacher, and student portals identically, so the flaw was role-independent. A zero-connection account that owned nothing was sufficient.

The Attack

Subscribing to Every Classroom

From a fresh self-registered account, opening a same-origin WebSocket to the proxy carried the session cookie automatically. Connecting and subscribing across the whole classroom channel namespace immediately streamed live behavior events. Each event carried the classroom id, the student identifiers, the behavior identifier, and the signed points value:

{"action":"reward","classroom":"<classId>",
 "students":["<studentId>"],"behaviour":"<behaviourId>",
 "points":-1,"awardedAt":"...","source_id":"<teacherId>-<device>"}

None of these classrooms belonged to the attacker. A scope probe confirmed this was a broken per-session scope and not a fully open broker: every other channel namespace (family, user, school, and the rest) returned a permissions violation, while only the classroom namespace was wrongly accepted.

Turning IDs Into Real Names

The identifiers were not a dead end. Each event from a mobile client also carried the owning teacher's id as a prefix of its source field. From the same session, a harvested student-and-teacher pair submitted to a connection-request endpoint returned the child's real name and the owning teacher's full name. That converted the live identifier feed into a platform-scale disclosure of real student names. The proof resolved a small slice and then deleted the requests it created so nothing persisted.

The Impact

A free, zero-connection account could read a live cross-classroom feed of children's behavior records from across the platform and resolve the identifiers in it to real student and teacher names. In a brief capture a fresh account observed hundreds of events from hundreds of distinct classrooms within seconds, and the feed sustained at that rate, harvesting thousands of distinct student identifiers in under a minute.

The exposure was read-only live eavesdropping: only the classroom tree was readable, a subscribe did not replay history, and a client publish was fan-out only and never stored, so an attacker could read live cross-tenant data but could not pull history or tamper with stored records. Because the platform serves school-age children, this is unauthorized cross-tenant exposure of minors' behavioral records, with the associated children's-privacy and education-records implications.

Remediation

• Derive the allowed classroom subjects from the authenticated session's actual class memberships and set the proxy permissions to exactly those subjects.
• Deny platform-wide subscriptions across the classroom channel namespace for all sessions.
• Add authorization on the name-resolution endpoint so it cannot be used as a free identifier-to-name oracle, and verify the caller has a legitimate relationship to the student.
• Add email verification and abuse controls to account sign-up.