The Forgotten Grant: How a Legacy OAuth Flow in an Android SDK Bypassed 2FA
12 min read
I want to walk through this finding the way it actually happened, not the cleaned-up, textbook version — because in bug bounty, the dead ends, false assumptions, and debugging rabbit holes matter…