Amadeus Merci (com.amadeus.merci.client.ui): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for Amadeus Merci.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Amadeus Merci
Private
2026-06-27
90d ago
Resolved
High
A real, decompiled Android app reads how you physically move your phone and treats that as biometric data, and bundles Chinese Alipay and Huawei software subject to China's national-security law. The company originally named as the operator, Amadeus, has denied any connection to this specific version in writing, and RFI-IRFOS has corrected the public record accordingly instead of defending a disputed attribution without evidence.
com.amadeus.merci.client.ui v26.6.0. All findings re-scored under CVSS v4.0. NuDetect behavioral-motion biometrics, a full Alipay+Huawei HMS stack (both PRC-NSL), and a production Chucker HTTP interceptor all reach HIGH on the computed score alone. Camera-based payment OCR, a shared obfuscated CyberfEnd SDK (also found in trivago and Air Canada), and a hardcoded Firebase key correct to MEDIUM. OPERATOR CORRECTION: Amadeus IT Group denied in writing, twice (27 Aug, 24 Sep), ever releasing version 26.x of this package; RFI-IRFOS withdraws the Amadeus attribution accordingly. No alternative historical operator has been independently confirmed; the package's current live listing resolves to Singapore Airlines Limited, a fact separate from who built the version reviewed.
click to expand
GDPR Art. 9GDPR PRC National Intelligence Law
Yes
Closed
Disclosure
90d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.