Frontier Airlines API Exposes Passport, Credit Card, and Personal Data via Boarding Pass Information
A security researcher known as BobDaHacker has revealed significant vulnerabilities in Frontier Airlines' booking system. These flaws enable anyone with a six-character booking code, or PNR, and a passenger's last name, both visible on every Frontier boarding pass, to access full personal records.
This information includes passport numbers, partial credit card details, and home addresses, all available through the airline's mobile API.
The issues were first reported to Frontier on March 3, 2026. As of June 18, 105 days later, the vulnerabilities remain unpatched.
What the API Exposes
Frontier's mobile API endpoint accepts a PNR and last name, then provides a full internal booking record for each passenger on the reservation.
The data available includes full home address details such as street, city, state, and ZIP code, as well as email address and phone number.
It also reveals complete date of birth information, including for minors, along with unmasked passport details like passport number, issuing country, and expiration date. Additionally, it exposes:
- The known Traveler Number, used for TSA PreCheck, and the
- The frontier Miles loyalty number. The credit card information includes the first six digits (BIN), the last four digits, the expiration date, the cardholder name, and the full billing address.
- The payment history data, complete with authorization codes, is also present.
Why the Credit Card Exposure Is Worse Than It Sounds
The exposure of credit card information is particularly significant. BobDaHacker explains that knowing the BIN (the first six digits) along with the last four digits reveals only five digits of the 16-digit card number.
The 16th digit is a check digit generated by the Luhn algorithm, which can be calculated from the other 15 digits. This leaves roughly 100,000 possible combinations for the middle digits that can be tested with a script in minutes.
Beyond its mobile API, BobDaHacker discovered that Frontier's website also leaks data through its Manage My Booking pages. The Passengers/Edit page, accessible with the same PNR and last name, shows full passport numbers, dates of birth, and KTNs, and the data is also embedded in a server-rendered JSON blob within the page source.
When Frontier previously tried to fix an earlier email leak on the Manage My Booking page, it introduced two new leaks, including one that exposed phone numbers.
A fourth vulnerability involved an endpoint that returned booking data from a PNR alone without requiring a last name; this was patched by Frontier.
The company sent the researcher a model airplane as acknowledgment. The remaining issues have not been fixed.
Disclosure Timeline And What Frontier Customers Should Do
BobDaHacker followed responsible disclosure practices. The initial vulnerability report was sent to Frontier on March 3, 2026, and multiple follow-ups were sent over the following months.
The formal 30-day disclosure deadline expired on June 12, 2026, without a response from Frontier. The public disclosure was published on June 18, 2026. As of now, Frontier has not issued a public statement.
Anyone who has flown with Frontier Airlines should take these steps to reduce their risk of exposure:
- Never share photos of boarding passes on social media, even if you redact personal details, because the barcode also contains the PNR and last name.
- Destroy printed boarding passes after travel instead of leaving them in trash bins where they could be recovered. Check credit card statements for any unauthorized charges, especially on cards used to book Frontier flights.
- Consider requesting a new credit card number from your bank if you recently made a booking with Frontier. If your TSA PreCheck or passport details were exposed, monitor for signs of identity theft.
Customers concerned about specific bookings can ask Frontier to remove their personal data from past reservations, although this does not guarantee protection from future API access.
Why Frontier’s Booking System Design Makes This Vulnerability So Serious
A former Frontier employee told BobDaHacker that the company’s booking system, known internally as IBE, was already considered a legacy codebase.
The employee said the team had been discussing plans to sunset and replace it. "IBE was a mess of generated config and code that only one person was senior enough to handle. Everyone else basically danced around it," the former employee wrote.
The vulnerability is notable for its scale, as anyone with a Frontier boarding pass could be affected, and for the airline's lack of action over more than three months following responsible disclosure.
Industry-standard timelines for responsible disclosure usually range from 30 to 90 days. Frontier has exceeded both.
This incident also underscores a broader issue: PNRs are printed on boarding passes because they are not considered secret. Building security around a boarding pass identifier creates risks for any airline.
In Frontier's case, their API treats the combination of PNR and last name as enough authentication to unlock complete passenger records, including financial and travel document data.
Help me
We have become a society that asks for so much proof of identity that we must do better with the entities that collect this information. They must be held to a higher accountability to protect all our information they collect.