# Deep link auth token interception

Auth codes or magic-link tokens delivered via unverified custom scheme or unverified app-link domain

_Area: Mobile app security. Seen in 3 disclosed reports; one confirmed bounty: $900; latest 2023-03-02. Updated 2026-10-24._

## How it works
Mobile apps receive login tokens through OS-level link routing, but the OS does not guarantee the link reaches the intended app. Custom URL schemes have no central registration, so any app can claim the same scheme. App Links / Universal Links are only safe when the app proves domain ownership (assetlinks.json / apple-app-site-association). When a token or authorization code is delivered over an unverified channel, another app can receive it. If the code is redeemable without a secret the receiver holds (no PKCE), interception becomes account takeover.

## Where it shows up
- OAuth redirect_uri using a custom scheme (e.g. `shopapp://`) with no `code_challenge`/PKCE [E1](https://bugbountylibrary.com/r/h1%3A1700734.md)
- Magic-link or login emails whose token sits in a third-party deeplink domain (Branch.io, Firebase Dynamic Links) [E3](https://bugbountylibrary.com/r/h1%3A855618.md)
- Missing or empty `assetlinks.json` / AASA for the domain the app claims [E3](https://bugbountylibrary.com/r/h1%3A855618.md)
- Android intent-filter / deeplink handlers that read stored secrets (session cookies) and act on attacker-supplied parameters [E2](https://bugbountylibrary.com/r/h1%3A1667998.md)
- Deep link parameters that control navigation or data returned to the caller

## How to review
For every auth-bearing link, identify the delivery channel and ask: can another app receive this link? The invariant: a token or code must only be redeemable by the app that requested it. Check (1) is the redirect a custom scheme or an unverified domain; (2) is PKCE enforced so a captured code is useless without the verifier [E1](https://bugbountylibrary.com/r/h1%3A1700734.md); (3) does the app verify domain ownership before trusting the link [E3](https://bugbountylibrary.com/r/h1%3A855618.md); (4) do deeplink handlers expose session material or privileged actions to arbitrary callers [E2](https://bugbountylibrary.com/r/h1%3A1667998.md). Treat any token arriving via an unverified channel as compromised.

## Variants seen
- OAuth authorization code over custom scheme without PKCE, exchanged for mailbox access [E1](https://bugbountylibrary.com/r/h1%3A1700734.md)
- Magic-link token over unverified Branch.io domain, full ATO [E3](https://bugbountylibrary.com/r/h1%3A855618.md)
- Malicious deeplink reaching the session cookie in an Android handler, one-click ATO [E2](https://bugbountylibrary.com/r/h1%3A1667998.md)

## Impact and severity
All three led to account takeover: email account access [E1](https://bugbountylibrary.com/r/h1%3A1700734.md), session cookie theft [E2](https://bugbountylibrary.com/r/h1%3A1667998.md), login token interception [E3](https://bugbountylibrary.com/r/h1%3A855618.md). Severity is high because a single clickable link suffices and no user warning appears. Worse when the token is directly redeemable (no PKCE) or grants broad account access.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1700734.md
- E2: https://bugbountylibrary.com/r/h1%3A1667998.md
- E3: https://bugbountylibrary.com/r/h1%3A855618.md