KAYAK · Report #1667998
1 click Account takeover via deeplink in [com.kayak.android]
Summary
We received this great report about a vulnerability in our Android app on August 12. An initial patch was made available via the Google Play Store on August 13 (version 161.2). The vulnerability had been introduced only very recently prior to its discovery and we have no indication that it has been exploited.
During my research of zero day vulnerabilities in mobile applications, I found that it is possible to steal a user's session cookie through a malicious deeplink in KAYAK v161.1. Below, I will explain in detail what this vulnerability is, where it is located in the code and what steps need to be taken to replicate the exploit.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.