We want to extend our sincere thanks to ty5ona who discovered and responsibly reported this flaw. Their work allowed us to quickly fortify our platform before any abuse could occur. Our engineering team immediately modified our system policies. We removed the wildcard access, ensuring that users can only subscribe to pinboards with an exact link.
An unauthenticated AWS Cognito Identity Pool exposed by Opera Pinboards permitted MQTT wildcard subscription (board/#) against the AWS IoT Core broker. This broadcast board UUIDs for all active users in real time to any unauthenticated subscriber, defeating the application's "anyone with the link" access model in which the board UUID functions as the sole access token for shared boards.
An attacker could obtain temporary AWS credentials from the public Cognito Identity Pool, subscribe to the wildcard topic, and passively harvest board identifiers as users interacted with their boards. Harvested UUIDs could then be used to access full board contents (items, descriptions, links, images) via the unauthenticated board API and public view endpoints, enabling systematic bulk enumeration of all active board content over time.
