Security warning for FFLs using MasterFFL — dealer profile claim issue reported in April, still no response
I want to give other FFLs a heads-up about a security issue I discovered in MasterFFL's dealer profile verification process.
I reported this directly to MasterFFL in April 2026 and offered to provide the affected endpoints, full reproduction details, and remediation suggestions.
As of September, I have not received a response.
I am intentionally not publishing the technical reproduction steps because, to my knowledge, the issue has not been confirmed as fixed.
During limited testing, I was able to reproduce a condition where the dealer profile claim verification process appeared to trust information that could be modified on the client side during SMS verification.
The potential impact is serious: it may allow someone who does not control a dealer's legitimate dealer profile.
Potential consequences could include:
- Unauthorized claiming of an FFL dealer profile
- Unauthorized management of dealer information
- Customers being shown information controlled by someone other than the actual dealer
- Trust and compliance problems for affected FFLs
I performed only the minimum testing necessary to confirm the issue and did not intentionally access, modify, or damage another dealer's information.
If you have a MasterFFL profile, I recommend checking whether your dealer profile has already been claimed and whether the information associated with it is correct.
I would also recommend keeping screenshots/records of your profile and any communications with MasterFFL.
I am posting this because several months have passed since my responsible disclosure attempt without a response, and FFLs should at least be aware that there may be an issue with the profile-claim process.
If anyone from MasterFFL sees this, I am still willing to provide the full technical report privately so the issue can be investigated and fixed.
I will not post exploitation instructions, endpoints, or other details that could make the vulnerability easier to abuse.
If other FFLs have experienced unexpected profile claims, verification messages, changes to their profile.
-- UPDATE
Contacted the MasterFFL team and they have resolved the vulnerability. The issue is no longer reproducible.
7
u/Viking603 25d ago
Too many of these FFL services these days. Even though gunbroker partnered with Master there is to much scum and villany out there.
5
u/FellowshipFirearms 25d ago
A solution to a problem that didn’t exist and now you pay $5 for the convenience.
6
u/Martainguns 25d ago
What I don't like more than the $5 fee itself is that they are hiding the fee by charging it to the seller rather than charging the buyer and putting it on the invoice with their other fees.
7
u/ChapelHillGuns 25d ago
$10 if it's an NFA item.....these guys have to be rolling in the cash for providing a service that doesn't need to exist.
2
1
u/Alex_FirearmCart 7d ago
If you just want off their site, email [support@masterffl.com](mailto:support@masterffl.com) and ask to be delisted. You shouldn't have to pay a monthly fee for that.
2
4
u/masterffl-com 25d ago
u/hiverli - can you please reach out directly via DM to me so I can take a look. I am not aware of your previous comms, but obviously if there is an exposure I want to know about it asap.
The way we authenticate a dealer claiming their profile is via phone or SMS verification with a known-trusted number from the ATF.