AT&T has patched a critical zero-day vulnerability that could have been exploited by attackers to take over any user’s ATT.com account using only the victim’s zip code and phone number. The flaw was discovered by a security researcher named Joseph Harris after he was able to abuse and exploit an account merging feature, allowing him to merge his own account with any other user account he wanted. According to Harris’ proof-of-concept (PoC) exploit, the attack is made possible by creating a free ATT.com profile, then using a button called “combine accounts” and selecting “already registered accounts.” The attacker is then prompted to enter the account phone number and zip code, disclosing the victim’s account and sending a prompt to the victim to enter their password. Harris utilized the ATT.com backend to intercept the password request to the victim, rerouting it to accounts he already owned. Once an attacker receives the victim’s password, they can carry out a host of malicious activity including account takeover, SIM swapping, and adding other devices or phone numbers to a victim’s account. Several well-known researchers have publicly stated that this is a very dangerous vulnerability given how easy it is to exploit. Roger Grimes from KnowBe4 also stated that the ease of which anyone could merge accounts is troubling, and indicative of the fact that there are likely multiple related and unrelated ATT.com zero-day vulnerabilities that are still susceptible to exploitation. Telecommunications companies are very lucrative targets for both financially-motivated and state sponsored threat actors, and the Federal Communications Commission (FCC) has confirmed that there have been multiple breaches impacting some of the largest providers like Verizon, T-Mobile, and AT&T.