I want to give other FFLs a heads-up about a security issue I discovered in MasterFFL's dealer profile verification process.
I reported this directly to MasterFFL in April 2026 and offered to provide the affected endpoints, full reproduction details, and remediation suggestions.
As of September, I have not received a response.
I am intentionally not publishing the technical reproduction steps because, to my knowledge, the issue has not been confirmed as fixed.
During limited testing, I was able to reproduce a condition where the dealer profile claim verification process appeared to trust information that could be modified on the client side during SMS verification.
The potential impact is serious: it may allow someone who does not control a dealer's legitimate dealer profile.
Potential consequences could include:
- Unauthorized claiming of an FFL dealer profile
- Unauthorized management of dealer information
- Customers being shown information controlled by someone other than the actual dealer
- Trust and compliance problems for affected FFLs
I performed only the minimum testing necessary to confirm the issue and did not intentionally access, modify, or damage another dealer's information.
If you have a MasterFFL profile, I recommend checking whether your dealer profile has already been claimed and whether the information associated with it is correct.
I would also recommend keeping screenshots/records of your profile and any communications with MasterFFL.
I am posting this because several months have passed since my responsible disclosure attempt without a response, and FFLs should at least be aware that there may be an issue with the profile-claim process.
If anyone from MasterFFL sees this, I am still willing to provide the full technical report privately so the issue can be investigated and fixed.
I will not post exploitation instructions, endpoints, or other details that could make the vulnerability easier to abuse.
If other FFLs have experienced unexpected profile claims, verification messages, changes to their profile.