Mental health apps vulnerable, exposing sensitive user data

As reported by Bleeping Computer, several popular mental health mobile applications available on Google Play, with millions of combined downloads, have been found to contain significant security vulnerabilities that could expose users' highly sensitive medical information and therapy data.

Security researchers at Oversecured scanned 10 mental health apps, uncovering a total of 1,575 vulnerabilities, including 54 rated as high-severity. These issues range from insecure data storage and weak encryption to flaws in handling user-supplied data, potentially allowing attackers to intercept login credentials, spoof notifications, or gain access to therapy records. Some apps were found to store data locally in an accessible manner, while others used insecure methods for generating session tokens or encryption keys.

The apps, designed to help users with conditions like depression, anxiety, and bipolar disorder, often claim to keep conversations private or encrypted, but the vulnerabilities undermine these assurances. The collective download count for the affected apps exceeds 14.7 million.

Source: Bleeping Computer