Security Researcher Flags Critical Vulnerabilities in Election Commission Voting App and Website

According to reports published on October 8, 2026, researcher Nisarga Adhikary said he had alerted the Election Commission of India (ECI) and the Indian Computer Emergency Response Team (CERT-In) about the issues in July. The developments have brought renewed attention to the importance of cybersecurity in India's increasingly digital election administration.

The concerns are particularly significant because election technology supports several activities beyond voting itself. Digital platforms help citizens access voter services, allow officials to coordinate election-related work, and facilitate reporting of potential violations during the electoral process. A vulnerability in these systems can create risks involving personal information, unauthorised access, and the reliability of administrative operations. However, reported security weaknesses should not automatically be interpreted as evidence that votes have been manipulated or election results compromised. The central question is whether the identified vulnerabilities were adequately investigated, how quickly they were addressed, and whether appropriate safeguards are now in place.

What Are the Reported Vulnerabilities in the ECINET App?

ECINET is a unified digital platform developed by the Election Commission to bring together more than 40 election-related applications and services. Its ecosystem includes services associated with election observers, candidates, election permissions, and cVIGIL, which allows citizens to report suspected violations of the Model Code of Conduct. Integrating these functions can make election administration more efficient by reducing the need to navigate separate systems. However, centralising multiple services within one digital environment also makes secure software design, access controls, encryption, and regular security testing particularly important.

According to the researcher's reported findings, several weaknesses involved how the application communicated with servers and protected information. He alleged that some security checks used to verify whether the application was communicating with legitimate Election Commission servers were disabled or could be bypassed. He also reported that certain encryption keys and a fixed access token were embedded in the application, potentially weakening the protection of data exchanged with backend services. If independently confirmed and exploitable under the conditions described, such weaknesses could increase the risk of information being intercepted, exposed, or manipulated. Their actual impact, however, depends on the affected components, access requirements, and other security controls operating within the system.

The researcher also raised concerns about certain cVIGIL-related endpoints reportedly returning valid responses without individual authentication. Because cVIGIL supports the reporting of potential election-code violations, its security is important for maintaining confidence in the reporting process and protecting associated information. A weakness in an endpoint does not automatically mean that every record is publicly accessible or that submitted complaints can be altered. Nevertheless, any unexpected response from a live service deserves careful investigation to establish what information is exposed, whether unauthorised actions are possible, and what restrictions should be implemented. Security assessments must distinguish between a demonstrated technical weakness and the broader consequences that might follow if an attacker successfully exploited it.

Voter Services Website Raises Data Privacy Concerns

Alongside the mobile application, the researcher's report identified a potential weakness in a server associated with the Election Commission's voter services website. According to the published account, the server could return election officials' names and mobile numbers without requiring a login or CAPTCHA, and requests did not appear to be subject to an effective limit. The researcher reportedly tested queries covering one state and three categories of officials before stopping, stating that he did not download a dataset. If the reported behaviour was reproducible, it could expose official contact information to automated collection and increase the risk of impersonation, targeted phishing, or fraudulent communications.

The potential consequences extend beyond the initial exposure of contact details. Cybercriminals can use publicly accessible information to create convincing messages that appear to come from election authorities, potentially persuading recipients to disclose credentials or respond to fraudulent requests. Repeated automated queries may also place unnecessary pressure on a service if effective request limits are absent. These are potential risks rather than proof that such attacks have occurred through the reported vulnerability. Even so, public-facing government websites should apply appropriate authentication, authorisation, rate limiting, monitoring, and data-minimisation measures wherever sensitive information or administrative functions are involved. Protecting official information is an important part of maintaining the integrity of digital public services.

CERT-In Confirms One Fix, While Other Issues Remain Under Review

The timeline of the disclosure has become a central part of the controversy. According to reports published by Hindustan Times and Moneycontrol, Adhikary said he emailed CERT-In on July 8, 2026, copying the Election Commission's complaints address. On October 6, CERT-In reportedly informed him that the concerned organisation had fixed a vulnerability described as involving client-side static response encryption and a hardcoded AES key. The agency also indicated that the remaining reported issues were under progress. The acknowledgement followed media inquiries made to the authorities on October 5, raising questions about the time taken to communicate the status of the findings.

The reported fix is a step towards addressing the concerns, but it does not establish that every vulnerability has been resolved or that the entire platform has undergone independent security validation. A hardcoded encryption key can undermine the protection provided by encryption if an attacker can retrieve the key from publicly available application code. Effective security requires more than concealing or scrambling data: sensitive operations must be protected by appropriate server-side controls, robust authentication, and properly managed cryptographic keys. The remaining findings therefore require clear technical assessment, remediation, and verification. Public reporting has not established that every alleged weakness was successfully exploited, and the precise status of each issue should be distinguished from the researcher's initial assessment.

Why Election Cybersecurity Matters for Public Trust

Election security involves more than protecting electronic voting machines or preventing interference with vote counts. It also includes safeguarding electoral databases, official communications, voter services, complaint-handling platforms, and the systems used by election administrators. When these systems operate securely, they can make public services more accessible and help officials coordinate their responsibilities. When vulnerabilities remain unresolved, however, they may create opportunities for data exposure, impersonation, service disruption, or unauthorised administrative activity. Even when no direct interference with an election has been demonstrated, uncertainty about the security of official platforms can weaken public confidence in the institutions responsible for conducting elections.

It is important to distinguish administrative cybersecurity from the security of vote recording and counting. The reported ECINET findings concern digital services and potential weaknesses in data protection or application communications; they do not, by themselves, demonstrate that votes recorded through electronic voting machines have been changed. Establishing any connection to electoral outcomes would require specific technical evidence and a separate investigation. Responsible reporting should therefore avoid treating the existence of a software vulnerability as proof of election manipulation. At the same time, the absence of evidence of altered votes is not a reason to dismiss weaknesses in supporting infrastructure. Every system that handles election-related information deserves appropriate security controls and transparent oversight.

What Should Happen Next?

The immediate priority should be a comprehensive technical assessment of the reported vulnerabilities across the affected website, application, and associated backend services. Independent security professionals should verify which issues remain exploitable, determine whether sensitive information was exposed, and establish whether any unauthorised access occurred. Remediation should be followed by repeat testing to confirm that the original weaknesses have been addressed without introducing new problems. Where necessary, authorities should review access permissions, remove exposed credentials or tokens, strengthen server-side validation, implement request limits, and improve monitoring for unusual activity. These measures would help move the response beyond individual fixes towards a more systematic cybersecurity programme.

Clear communication is equally important. The Election Commission and relevant cybersecurity authorities can strengthen confidence by providing an appropriate account of the issues investigated, the fixes completed, the outstanding risks, and the safeguards introduced. Responsible disclosure policies can also encourage researchers to report vulnerabilities through established channels without unnecessarily exposing sensitive technical details to potential attackers. Regular independent audits, secure software development practices, and timely patch management should be ongoing requirements rather than measures introduced only after a controversy emerges. A transparent remediation process would demonstrate that security concerns are being treated as operational priorities, while avoiding premature conclusions about the impact of vulnerabilities that have not been independently established.

Conclusion

The reported vulnerabilities in India's ECINET application and voter services website highlight the cybersecurity challenges associated with managing essential public services through interconnected digital platforms. Researcher Nisarga Adhikary's disclosures have raised concerns about potential exposure of election officials' contact details, weaknesses in application communications, and the response time for addressing reported flaws. CERT-In's reported confirmation of one fix is a development worth noting, although the remaining findings require further assessment and verification. Ultimately, securing election technology requires continuous testing, prompt remediation, accountable oversight, and clear communication with the public. The available reporting does not establish that votes were altered or election results compromised, but it underscores why weaknesses in supporting electoral systems should be investigated seriously. As digital platforms become increasingly important to election administration, maintaining strong cybersecurity standards will remain essential to protecting information, supporting officials, and preserving public confidence in democratic institutions.