abdelnasserr.medium.com
Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-11-08.
| Date Added | Resource | Excerpt |
|---|---|---|
| 2026-11-08 2026 | One Deep Link, Zero Validation, Full ATO (Again)AuthNBug BountyMobile | This article details a security vulnerability where a single deep link lacked proper validation, leading to Account Takeover (ATO). The author demonstrates how this flaw allows unauthorized access to user accounts, highlighting the critical importance of validating all input, especially within deep links. The repeated nature of such vulnerabilities underscores a persistent issue in web security. |
| 2026-11-05 2026 | Stealing App Internal Files via Intent Redirection to Insecure WebViewMobile | This vulnerability allows attackers to steal internal app files by redirecting intents to an insecure WebView. By manipulating intents, an attacker can trick the application into loading a malicious HTML page within its WebView component. This page can then access and exfiltrate sensitive files stored locally by the app, potentially leading to data breaches and privacy violations. |
| 2026-11-04 2026 | Intent Redirection to One-Click Account Takeover (But It’s a Duplicate)AuthNBug Bounty | This report details an intent redirection vulnerability that could lead to a one-click account takeover. However, the vulnerability was ultimately classified as a duplicate. |
| 2026-11-04 2026 | One-Click Account Takeover via WebView Auth Header Injection to Claimable Whitelisted DomainAuthNMobile | This article details a critical security vulnerability allowing one-click account takeover. The exploit leverages WebView's handling of authentication headers in conjunction with a claimable whitelisted domain. Attackers can inject malicious authentication headers, enabling them to hijack user sessions and gain unauthorized access to accounts without requiring any user interaction beyond a single click. |
| 2026-11-04 2026 | One-Click Cookie Theft via Deep Link XSS (But Deep Links Are Out of Scope)Bug BountyXSS | A security researcher discovered a vulnerability allowing one-click cookie theft through Deep Link Cross-Site Scripting (XSS). However, this specific attack vector is explicitly excluded from the program's scope, meaning no bug bounty will be awarded for this particular finding. The researcher demonstrated how a malicious link could exploit deep linking functionalities to steal user cookies without requiring any interaction beyond a single click. |