How I Leak Other’s Access Token by Exploiting Evil Deeplink Flaw

Introduction

Deep linking has become a crucial aspect of modern mobile app development, allowing for seamless navigation within and between apps. However, this seemingly flawless feature of deep linking can become a point of exploitation due to misconfigurations in many Android apps.

In this article, I’m going to talk about deep linking and the bug I found that allowed me to steal another user’s access token. So, let’s just begin.

What the deeplink doin?

Have you ever clicked on a …

access access token android bug bounty deeplink exploiting flaw infosec leak token