Lovense Connected Toy
Lovense (Shenzhen Lianwan Technology) · Intimate Device
Staff Reviewed — a person at DeSpy reviewed this rating.
Index
Its account system let anyone convert a public username into a user's email in under a second and take over accounts with just an email, exposing roughly 11.37 million users in 2025.
Why this rating
Lovense's account system let anyone convert a public username into a user's email in under a second, exposing roughly 11.37 million accounts to takeover in 2025 — a critical security failure affecting a highly sensitive device category.
What it is
- Requires a cloud account
- Works offline
- Manufacturer
- Lovense (Shenzhen Lianwan Technology)
- Category
- Intimate Device
- Model years
- 2011-present
- Market status
- Current
- Companion app
- Lovense Remote
The evidence 4
Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.
-
Independent researcher follow-up showing the Lovense email-leak vulnerability remained exploitable after the initial disclosure.
Why it matters here: Follow-up confirming the vulnerability remained exploitable.
-
TechCrunch reports a vulnerability let anyone convert a Lovense user's public username into their private email address in under a second, enabling account takeover.
Why it matters here: TechCrunch's direct report on the Lovense email-exposure and account-takeover vulnerability.
-
The Verge's coverage of the Lovense app vulnerability exposing user email addresses and enabling account hijacking.
Why it matters here: The Verge's coverage of the Lovense vulnerability.
-
Vice's reporting on the scale of the Lovense email-exposure vulnerability and the company's slow initial response.
Why it matters here: Vice's reporting on the scale of the exposure and slow company response.
Are you the maker? Respond to this finding
Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.
Think something here is wrong?
Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.
Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.