---
id: 4280
title: "AirDroid Web Application Authentication Flaw"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/airdroid-web-app-advisory"
published_at: "2015-04-15T00:00:00Z"
tags: ["android", "vulnerability", "advisory", "session-hijacking", "airdroid", "jsonp"]
phying_url: "https://phying.com/item/4280"
lang: en
---

# AirDroid Web Application Authentication Flaw

## Summary

Technical advisory on AirDroid 3.0.4 and earlier: its web app relied on JSONP for cross-origin requests, letting a malicious page generate a valid session token and hijack full device functionality.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2015-04-15T00:00:00Z
- **Original:** https://bishopfox.com/blog/airdroid-web-app-advisory
- **Phying News:** https://phying.com/item/4280