Basecamp · Report #2552879
Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com
Validstatus
mediumseverity
31upvotes
9 Jul 2024disclosed
Summary
It is possible to send authenticated requests to the server at app.hey.com and read the server's reply by running a malicious app in the same device as the HEY app.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.