Bypassing Spotify’s Android OAuth Client Binding

📰 Medium · Cybersecurity

Learn how a vulnerability in Spotify's Android OAuth client binding can be exploited using startActivity() instead of startActivityForResult(), allowing any zero-permission Android app to impersonate a registered client

advanced Published 15 Sept 2026

Action Steps

Identify the difference between startActivity() and startActivityForResult() in Android
Understand how OAuth client binding works in Spotify's Android app
Exploit the vulnerability by using startActivity() to impersonate a registered Spotify OAuth client
Test the exploit on a zero-permission Android app
Analyze the security implications of this vulnerability and propose potential fixes

Who Needs to Know This

Security researchers and Android developers can benefit from understanding this vulnerability to improve the security of OAuth client bindings in Android apps

Key Insight

💡 Using startActivity() instead of startActivityForResult() can bypass Spotify's Android OAuth client binding, allowing unauthorized apps to access user data

Full Article

How startActivity() instead of startActivityForResult() lets any zero-permission Android app impersonate a registered Spotify OAuth client. Continue reading on Medium »

Read full article → ☆ Save to playlist ← Back to Reads