# 1 click Account takeover via deeplink in [com.kayak.android]

Malicious deeplink in KAYAK Android v161.1 leaked the user's session cookie, enabling one-click account takeover.

- Payout: hidden
- Severity: critical
- Program: KAYAK
- Found by: retr02332
- Disclosed: 2023-01-19
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1667998
- Library page: https://bugbountylibrary.com/r/h1%3A1667998
- Tags: area:mobile domain:mobile impact:ato impact:data-leak kind:bounty platform:hackerone sev:critical tech:android technique:source-review vuln:access-control vuln:account-takeover

**Target:** Android app com.kayak.android deeplink handler
**Root cause:** Improper access control in the Android deeplink handler allowed an attacker-supplied deeplink to extract and exfiltrate the user's session cookie.
**Steps:**
1. Install KAYAK Android v161.1
2. Craft a malicious deeplink targeting the vulnerable handler
3. Deliver deeplink to victim (click)
4. Observe session cookie exfiltrated to attacker-controlled endpoint
5. Replay cookie to hijack victim account
**How found:** Researcher was hunting zero-days in mobile apps and analyzed KAYAK's deeplink handling, identifying that a malicious deeplink could reach the session cookie.
**Exploitation:** Attacker sends a crafted deeplink; victim clicks it; the app's deeplink handler passes the session cookie to an attacker-controlled destination, which the attacker replays to take over the account.
**Insight:** Audit Android deeplink/intent handlers for parameters that can redirect or leak stored secrets like session cookies; a single clickable link is enough for full ATO.