Read the researcher's report on HackerOne
An Android deep link accepted an unchecked destination, allowing a webpage or another app to redirect in-app traffic. The report says sensitive request headers could be captured, though compensating controls limited the impact.
How it was found
- The researchers examined the app’s deep-link feature.
- They observed that the destination was not validated.
- They tested invocation from a webpage or separate app and found traffic could be redirected to an attacker-controlled destination.
- They confirmed that sensitive headers could be exposed.
- Access needed
- No account
- User interaction
- Needed
- Whose object
- No object involved
- Boundary crossed
- A webpage or app redirected in-app traffic to an unvalidated destination, exposing sensitive headers.
- Root cause
- The deep-link handler failed to restrict or validate the requested destination.
- Impact
- An attacker could redirect a user’s session and collect sensitive headers, subject to compensating controls.
- Fix
- PayPal resolved the issue, but the report does not describe the specific fix.
- Components
- Android app deep-link handler, in-app webview
- Confidence
- medium
Open redirectDeep link abuseInformation disclosure
This analysis is CyberSIXT's own summary of the public report, written by a model and checked automatically. It may be wrong: the researcher's report is the source. Written 2026-11-14. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Redirection in Repeater & Intruder Tab | A user account | No object involved | A user-triggered redirect caused referrer information to be sent to a destination. |
| XSS and Open Redirect on MoPub Login | No account | No object involved | The login flow sent an authenticated user to an attacker-controlled destination and reportedly allowed script execution. |
| Open redirect at https://inventory.upserve.com/http://google.com/ | No account | No object involved | The site redirects a visitor from its trusted origin to an attacker-chosen external domain. |
| Open Redirect in Logout & Login | No account | No object involved | The logout flow redirected a visitor from the service to an attacker-controlled external site. |
| [Venmo Android] Remote theft of user session | A user account | No object involved | An external link crossed into the app's URL handler and redirected to an unvalidated destination, exposing session data. |
| Open redirect due to scanning QR code via brave browser | No account | No object involved | Scanning a QR code directly opens its external destination without a confirmation step. |
| Open URL Redirection | No account | No object involved | The registration flow redirected a user from the service to an external site. |
| Open redirect vulnerability | No account | No object involved | A link on the redirecting subdomain sent visitors to an attacker-chosen external domain. |
| Bypass of Open Redirect Fix on lovable.dev via /..// Path Traversal in redirect parameter | A user account | No object involved | A post-login redirect left the trusted application domain for an external site. |
| Open Redirect on ███████ | No account | No object involved | The application redirected a visitor from its trusted origin to an external destination. |
| Open Redirect | No account | No object involved | A link on the trusted site allegedly redirects a visitor to an external destination. |
| Open Redirect | No account | No object involved | The site redirects a visitor from its own origin to an external destination. |