tl;dv AI notetaker vulnerability exposes government and corporate video calls to any user
This digest was compiled by AI from multiple sources — links to the originals are below.
A vulnerability in AI meeting assistant tl;dv — used by over two million users including Salesforce, Forbes, and dozens of government agencies — allows any user to access meeting metadata and join live video calls, a security researcher has found. Researcher BobDaHacker discovered in January that any logged-in user can query tl;dv’s Google Firestore database to obtain timestamps, creator emails, and join video conferences of other users. The flaw remains unpatched, and tl;dv has not responded to attempted disclosures by the researcher or Dark Reading.
The Firestore Vulnerability
When a user signs into tl;dv, the app assigns a session ID that allows querying the Cloud Firestore database. While most data is isolated, the 'meetings' collection has no tenant isolation. This enables any authenticated user to retrieve information about every live video call into which tl;dv is invited. The metadata includes meeting timestamps, recording status, and the creator’s email address, which can be used to identify the target organization. According to researcher BobDaHacker, securing this requires only a few lines of Firestore security rules that scope reads to the authenticated user’s organization, a configuration Google’s documentation explicitly instructs developers to implement.
Scope of Exposure
Tl;dv markets itself as trusted by more than two million users worldwide, including Salesforce, Forbes, and Cloudflare. The researcher found it is also used by dozens of government agencies and large universities across multiple countries. Using the exposed metadata, BobDaHacker was able to identify and join live calls hosted by these entities. The vulnerability potentially compromises confidential discussions across corporate, governmental, and academic sectors. Tl;dv’s website claims automatic joining of all calls unless users opt out, meaning many meetings are recorded by default.
Response Failure
BobDaHacker discovered the flaw in late January and attempted to report it to tl;dv, but received no response. Dark Reading also reached out to tl;dv’s press and marketing contacts before publication but did not receive a reply. As of the time of writing, the vulnerability remains live. The researcher noted that the fix is simple — a few lines of security rules — yet it has not been implemented. This lack of response raises concerns about the company’s security practices and incident handling.
What's Next
Tl;dv has yet to comment or issue a fix, and it is unclear when the vulnerability will be addressed. The incident highlights broader risks in AI meeting tools and raises concerns about third-party access to sensitive conversations, with experts warning that similar misconfigurations may exist in other services.
1 source
tl;dv AI notetaker vulnerability exposes government and corporate video calls to any user
