11-12-2025, 12:30 PM
High
resolved
resolved
Two click Account Takeover
Bug reported by Franc Vian was disclosed at November 11, 2025, 9:14 am | Deserialization of Untrusted Data
A vulnerability was discovered in the HEY Email Android application that allowed for a two-click account takeover. Improper handling of incoming deeplinks led to the application's authorization bearer token being sent to an attacker-controlled server if the user could be tricked into clicking a link and then performing an Undo action.