Insecure Authentication/Authorization
Mobile apps with weak authentication — storing sessions insecurely, missing token refresh, or authorization checks only on the client side.
How It Works
Mobile auth is tricky because the app runs on an untrusted device. Common mistakes include storing auth tokens in AsyncStorage without encryption, not refreshing expired tokens, performing authorization checks only in the mobile code (which can be bypassed), or using weak biometric implementation that falls back to a simple PIN. Attackers can modify the app binary to skip auth checks entirely.
// Storing token insecurely
import AsyncStorage from '@react-native-async-storage';
await AsyncStorage.setItem('auth_token', token);
// No expiration check, no encryption// Using encrypted storage
import EncryptedStorage from 'react-native-encrypted-storage';
await EncryptedStorage.setItem('auth_token', token);
// Token has expiration, refresh logic on 401Real-World Example
In 2019, researchers found that multiple banking apps stored authentication tokens in plaintext in Android's SharedPreferences. Any app with root access or a local backup could extract these tokens and impersonate the user.
How to Prevent It
- Use encrypted storage for tokens (Keychain on iOS, EncryptedSharedPreferences on Android)
- Implement token refresh with short-lived access tokens
- All authorization checks must happen on the backend
- Implement certificate pinning to prevent MITM attacks
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
Improper Credential Usage
criticalHardcoded API keys, passwords, or tokens directly in mobile app source code — easily extracted by decompiling the app bundle.
Mobile Supply Chain Security
mediumVulnerable SDKs, outdated native libraries, or compromised third-party modules in your mobile app introduce security risks from your dependencies.
Insufficient Input/Output Validation
mediumMobile apps that don't validate user input or sanitize output are vulnerable to injection attacks, data corruption, and unexpected behavior.
Insecure Communication
highMobile app transmits sensitive data over HTTP instead of HTTPS, or accepts invalid SSL certificates — enabling man-in-the-middle attacks on public WiFi.