🔺Severity: Medium
👽 Reporter: zerodaysec xyz
⭐️ Reputation: 201
🛠 State: resolved
💼 Team: Basecamp
💵 Bounty: 287
🕐 Submitted: 2026-05-27
⏰ Disclosed: 2026-07-04 11:05:36
📝 Summary: A vulnerability was discovered in the Basecamp Android app that allowed any installed app to force immediate logout and persistent denial-of-service of authenticated Basecamp sessions. The vulnerability was due to the
com.basecamp.bc4.app.main.start.StartActivity being declared as exported without any permission guard. This allowed any app to launch it with an explicit intent, terminating the current session and forcing the user back to the login screen. The behavior was confirmed to be reliable, silent, and persistent.📂 Report JSON File: 3764217
@hackeronereports