The Immigration Bug That Exposed My Passport (+ 300,000 Others)

It’s the night before my flight to Nigeria. I sit in bed and complete the final documentation needed to enter the country. My email confirmation leads me to the link for my approved Landing Card:

https://lecard.immigration.gov.ng/landing-preview/305122

When I see my data online, I’m instinctively curious about whether it’s secure. I notice from the URL of my Landing Card that I’m 305122. I change the number to 100 and sure enough, the details of Mr. S[redacted] show up.

The records appear to be in order of application, starting in June 2025, and they cover more than 300,000 non-Nigerian citizens who have entered the country since. For each of these visitors, an endpoint displays their full name, passport number, visa number, email, phone number, and details of their stay (such as length and address).

I almost couldn’t sleep. I wrote my Responsible Disclosure Vulnerability Report while on the plane and reported it the day I landed. When I left the country, I begrudgingly noticed that the Exit Card endpoint was vulnerable too; mine is hosted on /exit-preview/201152, but changing the numerical ID shows the same sensitive information for other travelers. It’s interesting to note that I was the 305,122nd person to enter the country since June and the 201,152nd person to leave.

I eventually got in touch with a senior immigration official, and they were able to drive a fix for the two IDOR vulnerabilities. I’m glad that stumbling across a national-security-level dataset from my bed ended with hundreds of thousands of travelers’ passports secured.

---

Disclosure Timeline:

• 1/16/2026: Sent initial email to lecard@immigration.gov.ng and incident@cert.gov.ng.
• 1/23/2026: Submitted formal ticket at cert.gov.ng and followed up via email to both of the previous addresses
• 2/03/2026: Reported vulnerability to the Nigeria Portal page on HackerOne
• 2/10/2026: Reported vulnerability to the CISA Incident Reporting System
• 2/21/2026: Sent follow-up to lecard@immigration.gov.ng and incident@cert.gov.ng.
• 3/08/2026: Contacted Nigerian Immigration Officials via social media
• 8/21/2026: Verified the issue was fixed