Avelo Airlines PNR Flaw Exposed Millions of Passenger Records to Brute Force

December 19, 2025 at 06:15 PM•2 min read

Avelo Airlines quickly patched a critical PNR system vulnerability that exposed millions of passenger records and sensitive PII.

Key Points

1Researcher discovered a critical vulnerability in Avelo's PNR system due to missing last name verification and rate limiting on reservation endpoints.
2The flaw allowed an attacker to brute-force 2.18 billion PNR combinations, potentially accessing all passenger data in approximately six hours.
3Exposed data included full PII, Known Traveler Numbers, passport details, flight itineraries, and partial payment card information.
4Avelo Airlines responded professionally, patching the critical security issues within four weeks of the initial responsible disclosure contact.

Avelo Airlines successfully remediated a critical security vulnerability within its Passenger Name Record (PNR) system that could have allowed an attacker to access sensitive personal and government identification data for millions of passengers. The flaw stemmed from two primary security lapses: the reservation lookup endpoint did not require a passenger's last name for verification, and the system lacked effective rate limiting. This configuration meant that the 6-character alphanumeric PNR code was the sole barrier to entry.

Security analysis showed that the total keyspace of 2.18 billion combinations (36^6) was highly susceptible to brute-force attack. Without rate limiting, an adversary using a modest server cluster could enumerate all valid reservations and extract passenger data within approximately six hours. The researcher who discovered the flaw demonstrated that the lack of rate limiting allowed their script to harvest hundreds of valid reservations, exposing troves of data including full names, dates of birth, contact information, and government IDs such as Known Traveler Numbers (KNTs) and passport numbers. Partial payment card details were also accessible.

The vulnerability was disclosed to Avelo Airlines on October 15, 2025. The airline’s cybersecurity team responded swiftly and professionally, acknowledging the severity of the findings. Avelo pushed a comprehensive fix to production on November 13, 2025, successfully patching both the missing last name verification and the lack of rate limiting on the affected endpoints. The successful and rapid remediation process was highlighted as a model example of effective security disclosure handling within the commercial aviation sector.