Klaviyo Sign-Up Form Misconfiguration Exposed User Passwords to Advertisers

A misconfigured Klaviyo sign-up web form exposed new customers' email addresses and passwords to third-party advertisers for at least 21 months, according to security researcher Sam Jadali, who detailed the findings ahead of a presentation at the Def Con security conference in Las Vegas. (TechCrunch)

Jadali, co-founder of cybersecurity startup Melurna, shared his research with TechCrunch on August 10, 2026. The findings center on a well-known class of vulnerability: website tracking pixels that are inadvertently configured to capture and transmit data entered into form fields on the pages where they are embedded. In this case, the Klaviyo sign-up form was leaking the full contents of new customer registrations to advertising platforms.

The exposed data included email addresses, passwords, company names, website addresses, and phone numbers. That information was shared with Facebook, Google, HubSpot, Microsoft and its subsidiary LinkedIn, and X.

Klaviyo, a Boston-based marketing company, says it has 205,000 paying customers and manages over seven billion customer profiles, according to its website. The company confirmed to TechCrunch that it fixed the website bug responsible for the exposure. Spokesperson Danielle Zanatta described the issue as an "application configuration issue" and said that fewer than 200 known individuals were affected, based on readily available active logs. (TechCrunch)

Klaviyo said it notified the known affected individuals but would not provide a copy of the communication it allegedly shared with them. The company did not publicly disclose the incident, and it is unclear why.

The misconfiguration persisted between at least February 2024 and November 2025. The gap between the apparent fix date and the public disclosure in August 2026 raises questions about Klaviyo's transparency obligations, though the company has not publicly explained the delay.

Pixel-based data leakage is not a new vulnerability category. Tracking pixels from major ad platforms can be embedded on any web page and, when misconfigured, will transmit the contents of form fields to the pixel operator's servers. The mechanics are straightforward: a pixel script that listens for form submission events and forwards field values to an advertising endpoint. The failure mode is typically a misconfiguration in how the pixel is integrated with the page's form elements, not a vulnerability in the pixel technology itself.

What makes this incident notable is the sensitivity of the exposed data. Email addresses and phone numbers being captured by advertising pixels is a known and recurring problem. Passwords being transmitted alongside that data is a more serious failure. Passwords entered into a sign-up form for a SaaS platform should never be present in a payload that an advertising pixel can read, which points to a form design that did not isolate credential fields from tracking scripts, or a pixel integration that was not scoped to exclude sensitive inputs.

Klaviyo's statement that fewer than 200 individuals were affected is drawn from "readily available active logs," which leaves open the question of whether older or less readily accessible log data might reveal a larger exposure window. The confirmed timeframe of at least February 2024 to November 2025 spans 21 months, and a sign-up form on a platform with 205,000 paying customers would typically receive substantial traffic over that period. The 200-affected figure may reflect the limits of available logging rather than the full scope of the exposure.

The distribution of exposed data to six major advertising platforms also complicates any remediation. Once password and email combinations reach an advertiser's ingestion pipeline, Klaviyo has no mechanism to recall or delete that data. Affected individuals face potential credential exposure that persists indefinitely on systems outside Klaviyo's control.

For affected users, the practical guidance is direct: change the password used for the Klaviyo account, and if that password was reused elsewhere, change those too. This is standard advice, but it bears repeating given that Klaviyo has not disclosed how many users were actually notified or what specific information was communicated to them.

The broader context here is that pixel misconfiguration incidents have appeared with regularity across the industry, and the pattern is consistent: a form on a high-traffic page, a pixel integration that over-captures, and a gap of months or years before anyone notices. Each incident is treated as isolated, but the recurrence suggests a systemic gap in how organizations audit their tracking integrations for data leakage. Organizations that embed third-party advertising pixels on pages containing form fields should treat those integrations as potential exfiltration channels and test them accordingly.