Case UC-10 · OWASP M1 Improper Credential Usage

OAuth client secret embedded in a mobile binary

A mobile client embedded an OAuth client secret intended for confidential clients. Because a distributed app cannot keep a secret, it was recoverable and usable to impersonate the app to its provider.

This article documents a representative, anonymised mobile application security case. It describes the weakness, why it matters to a business, how Mobexa detects it, and how to remediate it. No specific application, company or individual is identified.

Contents

  1. Context
  2. What the research team found
  3. Why it matters
  4. How Mobexa surfaces it
  5. Remediation
  6. Standards mapped

1 Context

A mobile client used an OAuth flow intended for confidential clients and embedded the client secret in the shipped app. A distributed mobile binary cannot keep a secret, so the value is recoverable by anyone who inspects the artefact.

2 What the research team found

The team recovered the client secret from the binary. With it, a third party can impersonate the application's identity to the authorisation provider, request tokens as though they were the legitimate app, and abuse any quota or trust the provider extends to that client.

3 Why it matters

Embedding a confidential-client secret in a public client undermines the assumptions of the authorisation flow. It enables impersonation and token abuse, and remediation requires rotating the secret and migrating to a flow designed for public clients, which affects every shipped build.

4 How Mobexa surfaces it

Mobexa detects OAuth and API client secrets in binaries and resources, distinguishes public-client tokens from confidential-client secrets, and flags the latter under M1 with location and remediation guidance.

5 Remediation

Use a public-client flow with PKCE and no client secret, move any confidential exchange to a backend, and rotate the exposed secret. Add secret scanning to the build pipeline to prevent recurrence.

6 Standards mapped

Table 1. Frameworks and references for this case
FrameworkReference
OWASP Mobile Top 10 (2024) M1 Improper Credential Usage
CWE CWE-798 Use of Hard-coded Credentials
OWASP MASVS MASVS-AUTH
credentialsoauthsecrets

See also

Documented by the Mobexa research team. This case is anonymised and provided for educational use; the mapping references the OWASP Mobile Top 10 (2024).