# Account takeover intercepting magic link for Arrive app

Arrive app's Branch.io magic-link domain lacked Android App Links verification, letting a malicious app intercept the login token and take over accounts.

- Payout: hidden
- Severity: low
- Program: Shopify
- Found by: nsl182
- Disclosed: 2020-07-15
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/855618
- Library page: https://bugbountylibrary.com/r/h1%3A855618
- Tags: area:mobile domain:mobile impact:ato kind:bounty platform:hackerone sev:low tech:android tech:graphql technique:recon vuln:account-takeover vuln:auth-bypass

**Target:** Android app deeplink / GraphQL auth endpoint (arrive-server.shopifycloud.com)
**Root cause:** The magic-link token is delivered via qvay.app.link deeplink, but the app never verifies ownership of that domain (empty assetlinks.json), so any app can register an intent-filter for it and receive the token.
**Steps:**
1. Observe login email links to `https://qvay.app.link/...?token=...&secret=...`
2. Check `https://qvay.app.link/.well-known/assetlinks.json` is empty (no App Links verification)
3. Malicious app registers intent-filter for scheme https, host qvay.app.link
4. Intercept the deeplink and extract the token
5. POST `/graphql` mutation `VerifyToken(token)` to arrive-server.shopifycloud.com to obtain `_arrive-server_session` cookie
6. Optionally trigger email via `SendVerificationEmail(email)` mutation which also returns a session cookie
**How found:** Researcher inspected the login email link, noticed the token exposed in a Branch.io URL, and checked assetlinks.json to confirm the domain was unverified, enabling deeplink hijack.
**Exploitation:** Malicious app either waits for victim to tap the magic link or self-triggers SendVerificationEmail (harvesting email via Android SDK), intercepts the deeplink token, then exchanges it via VerifyToken GraphQL mutation for a valid session cookie granting full account access.
**Insight:** Magic-link flows that route tokens through third-party deeplink providers (Branch.io, Firebase Dynamic Links) are hijackable if the app never verifies the domain via App Links/Universal Links; always check assetlinks.json/apple-app-site-association for the deeplink host.