Account Takeover via Misconfigured OAuth in Android

TL;DR: Two Android apps using Auth0 left redirect URIs in their allowlist that nothing on Android actually owned. PKCE wasn’t enforced…