---
id: 4205
title: "Amtrak Mobile APIs - Multiple Vulnerabilities"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/amtrak-mobile-apis-advisory"
published_at: "2019-02-19T00:00:00Z"
tags: ["authentication-bypass", "api-security", "ssl-pinning", "vulnerability-advisory", "pii-exposure", "amtrak"]
phying_url: "https://phying.com/item/4205"
lang: en
---

# Amtrak Mobile APIs - Multiple Vulnerabilities

## Summary

Amtrak mobile API authentication bypass and information disclosure exposed names, addresses, trip details and partial payment data for six million guest rewards members.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2019-02-19T00:00:00Z
- **Original:** https://bishopfox.com/blog/amtrak-mobile-apis-advisory
- **Phying News:** https://phying.com/item/4205