Android App Links autoVerify=false Allowed Hijacking Authentication Flows

Research is a constant process of failure and iteration. However, in most cases, you only see the one-in-a-thousand (successful) attempt. To normalize f*ck ups, and because I believe the behavior we identified in the course of this research is still relevant and interesting, this post is published for educational purposes. Implementing secure Single-Sign-On (SSO) flows on mobile platforms is a…