Flaws In Poll Body App ECINET Were Flagged To Cybersecurity Body Months Before Row

In July, a security researcher warned the Election Commission of India (ECI) and cybersecurity agency CERT-In about vulnerabilities in ECINET, the voter-services website and its app. Adhikary claimed these flaws could expose officials' contact details and allow attackers to read or forge data. However, despite notifying the agencies three months earlier, no fixes had been acknowledged by then.

Cert-In informed Adhikary on October 6 that one of the flaws had been fixed, with work on the rest ongoing. The specifics of when the fix occurred remain unclear. Adhikary initially emailed both agencies on July 8, with a copy sent to the ECI's complaints address. CERT-In responded by October 6, while the Election Commission did not respond to either.

The issues highlighted were not directly related to ECINET's restriction on Electoral Registration Officers accessing the voter roll database. Adhikary rated one flaw critical, emphasizing a server behind the voter portal that returned sensitive information without any login or caps. He tested this on a single state and three officer roles, noting the potential for large-scale data collection.

Additionally, Adhikary found issues with ECINET's Android app, which bundles several modules including cVIGIL. He discovered checks for authentic ECI servers were disabled, allowing interception or alteration of data on unsecured networks. Encryption keys and a fixed access token were also embedded within the app, enabling potential misuse.

Unencrypted storage of tokens, phone numbers, and bank details posed further risks. Adhikary tested the official app, noting it had been updated multiple times since his initial report in July 2026.