Basecamp · Report #2516732
Account takeover via insecure intent handling
Validstatus
mediumseverity
136upvotes
30 May 2024disclosed
Summary
By installing a malicious app on the same device where the Basecamp app is logged in, the attacker could obtain the Oauth2 token of the user logged in and take over his account.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.