LINE · Disclosed

Researchers: LINE encryption flaws let malicious server replay messages

Oct 26, 2026 · 1 min read

Aarhus University researchers detailed flaws in LINE's end-to-end encryption: a malicious server can silently replay, reorder or block messages, colluding users can forge a message's sender, and stickers leak plaintext. LINE's owner said no special action is required, and no fix has been released. Organizations using LINE for sensitive exchanges should assess the risk until a fix exists.

By HIFY Radar newsroom Updated 10/26/2026 05:03 PM Get this every day →← Back to the feed 1 source

MediumVulnerabilityDisclosedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Aarhus University researchers reported flaws in LINE's end-to-end encryption. A malicious server can silently replay, reorder or block messages, colluding users can forge who sent a message, and stickers leak plaintext. LINE's owner said no special action is required.

Why it matters

Anyone using LINE for sensitive exchanges is exposed: messages can be blocked or replayed undetected, and a message's sender can be forged by colluding users. No fix has been released, so the exposure remains in the current app.

What to do

Check whether LINE is used for critical or sensitive company communications. If so, evaluate alternative channels for those exchanges until a fix exists. Follow LINE's response to the research.

For the technical team

Affected: LINE (criptografia de ponta a ponta do aplicativo de mensagens) · LINE messaging app (end-to-end encryption). Versions not specified in sources.
Exploitation: No exploitation reported in sources. Flaws disclosed in Aarhus University research on October 26, 2026.
Fix: No fix released per sources. LINE's owner stated no special action is required.
Vector: Component: end-to-end encryption of the LINE messaging app. Design flaw: a malicious server can silently replay, reorder or block messages; colluding users can forge a message's sender; stickers leak plaintext.
More details: Flaws detailed by Aarhus University. Per the source, LINE's owner said last year that no special action is required. No PoC, CVE, or indicators cited in sources.