Two click Account Takeover

Summary

This report concerns the HEY Email Android application (com.basecamp.hey), which allows for a two-click account takeover. Due to improper handling of incoming deeplinks, the application can be manipulated to send the user's Authorization Bearer token to an attacker-controlled server if the attacker can trick the user into clicking a link and then performing an Undo action. The vulnerability specifically occurs in the MainActivity component when processing deeplinks with URL extras containing specific query parameters.