Rakuten Mobile patched an orchestration API flaw disclosed through JPCERT/CC on Friday, closing a path that let authenticated partners reassign subscriber profiles without a second approval step.
The bug lived in a provisioning API used by retail partners to activate SIM kits. Daiki Yamamoto’s security desk confirmed that exploitation required valid partner credentials, but once inside, an attacker could swap billing addresses and eSIM profiles across accounts that shared a storefront login.
Coordinated disclosure timeline
JPCERT/CC assigned the issue tracking id JVN#2026-10-0844 on Thursday after a university researcher reported it privately. Rakuten Mobile issued a server-side fix within 12 hours and forced token rotation for 214 partner integrations, a smaller set than its full marketplace but enough to cover nationwide electronics chains.
The carrier said it found no evidence of mass abuse, though it is still correlating logs from the Sports Day weekend when store traffic spiked. Customers do not need to replace SIMs, but partners must deploy a new SDK by 20 October or lose API access.
Regulatory context
The Ministry of Internal Affairs and Communications asked all mobile network operators to attest compliance with the July guidelines by month end. Yamamoto noted that Rakuten’s miss mirrors a broader industry gap: orchestration layers grew faster than security review boards could catalog.
Competitors NTT Docomo and KDDI declined to comment on whether their partner APIs enforce dual control; JPCERT urged carriers to publish attestation summaries rather than hiding behind generic security pages.
What subscribers should do
Rakuten Mobile posted a FAQ advising users to enable app-based login alerts and freeze profile edits from web browsers. Enterprise customers with pooled lines should audit which retail clerks still hold partner credentials after seasonal staffing surges.
Yamamoto’s desk will watch whether the incident triggers FSA scrutiny of Rakuten’s banking arm, which shares identity directories with the mobile unit. For now, regulators treat mobile provisioning as a telecom matter, but shared SSO increases blast radius if partner keys leak.
Retail partners received a checklist Friday night covering credential storage, offline POS modes, and mandatory dual approvals for profile swaps. Yamamoto said compliance teams should treat the SDK deadline as hard: stores that miss the update will display paper activation forms, slowing Sports Day phone sales.