Meine Allianz (AT) (at.aztec.customer): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for Meine Allianz (AT).
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Meine Allianz (AT)
Private
2026-06-26
91d ago
Silent
Critical
Allianz's app contains code that accepts absolutely any server certificate as valid, which means its encryption protection is effectively switched off, and anyone on the same network as you, like public wifi, could intercept your policy documents, accident claims with photos, and payment details. The app also backs up all of that same data to Google's servers with no exclusion rules, and still contains internal staging and test server addresses that should never have shipped. Neither Allianz nor its platform provider aztec ever replied.
at.aztec.customer v2.8.4, built on the aztec GmbH white-label platform. All four findings re-scored under CVSS v4.0. TLS certificate validation completely disabled (checkServerTrusted() empty, HostnameVerifier hardcoded true) plus cleartext explicitly enabled with no network security config reach HIGH/8.6 on the computed CVSS score alone and are held at CRITICAL under blast-radius escalation, a trivial MITM on any shared network against login credentials, claim submissions with photos, and payment methods, no special hardware required. Unrestricted Android backup over insurance policy, claims, and payment data reaches HIGH/8.7 without escalation. Hardcoded internal staging/test URLs and Adobe CMS infrastructure correct to MEDIUM. Five messages sent across 72 days to datenschutz@/presse@/kundenportal@allianz.at; the only replies were two automated FMA deflection acknowledgments, not from Allianz or aztec. No reply of any kind was ever received from either the controller or the processor. Case closed and published 2026-09-25, six days after the stated 2026-09-19 embargo.
click to expand
GDPR Art. 32
Yes
Closed
Disclosure
91d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.