Income Tax portal: any taxpayer's records, one PAN away
An insecure direct object reference let any logged-in user pull another taxpayer's full profile, including Aadhaar, bank accounts, and income, by changing one PAN value. More than 135 million registered accounts were in scope.
- Target
- Income Tax e-Filing Portal (Govt. of India)
- Bug class
- IDOR, broken access control
- Scale
- 135M+ registered PAN accounts
- Reported to
- CERT-In and the Income Tax Department
- Status
- Fixed, early Oct 2025
- Researchers
- Akshay CS and Viral Vaghela
What was the issue
The portal identifies each taxpayer by their Permanent Account Number (PAN). After login, the page loaded your profile by sending your PAN in background requests, and the server used whatever PAN the browser sent without checking that it belonged to the logged-in user.
Swapping in someone else's PAN returned that person's records. No fresh OTP or verification was asked for, so Aadhaar or SMS two-step protection on the victim's account made no difference. The attacker only needed their own login and the target's PAN.
What was exposed
- Name, father's name, date of birth, address, phone, and email
- Aadhaar number, where linked
- Every bank account linked to the PAN
- Employer, salary, and TDS details
- Income from all sources, pre-computed tax, deductions, and filing status
- Declared assets and past returns, typically up to five years
Company records registered on the portal were exposed the same way.
A second weakness
Session expiry was handled in the browser, so the server did not enforce logouts on its own.
Disclosure timeline
Found while filing our own tax returns.
Reported to CERT-In and the Income Tax Department.
CERT-In tells TechCrunch the department is working on a fix.
Flaw confirmed no longer exploitable.
TechCrunch publishes, after verifying the issue and waiting for the fix.
Decode publishes a detailed investigation.
The takeaway. Authorization has to be checked on the server for every record, against the session, never against an identifier the client sends.
