HealthForYou 1.11.1 / HealthCoach 2.9.2 Missing Password Policy

Posted on 05 November 2021

HealthForYou version 1.11.1 and HealthCoach version 2.9.2 are missing a server-side password policy. When creating an account or changing your password the mobile and web application both check the password against the password policy. But the API assumes that the given password is already checked therefore an attacker can intercept the HTTP request and change it to a weak password.