1. Reporting information

Team name : Team Brrester

2. Overview of Vulnerabilities

• Vulnerability title: Deeplink Redirect
• Date of discovery: 2025.06.05
• Discovery Location (URL or System Path) com.mcu.reolink/com.android.bc.account.smart.AlexaToSmartHomeActivity
• Vulnerability Type (CWE ID): CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
• Vulnerability Description: A Deiplink Open Redirect vulnerability that allows an attacker to manipulate the 'redirectUri' parameter to direct a redirection to a malicious external app or website without the user's click. Run user inputs as 'Int.ACTION_VIEW' without verification inside the app.

3. Details

• Impacted Products/Services: Reolink App
• Product version: Reolink 4.54.0.4.20250526
• Vulnerable Components: com.mcu.reolink/com.android.bc.account.smart.AlexaToSmartHomeActivity

<activity
            android:theme="@style/ContainerTheme"
            android:name="com.android.bc.account.smart.AlexaToSmartHomeActivity"
            android:exported="true"
            android:launchMode="singleTask"
            android:screenOrientation="portrait">
            <intent-filter android:autoVerify="true">
                <action android:name="android.intent.action.VIEW"/>
                <category android:name="android.intent.category.DEFAULT"/>
                <category android:name="android.intent.category.BROWSABLE"/>
                <data android:scheme="https"/>
                <data android:host="apis.reolink.dev"/>
                <data android:host="cloud.reolink.review"/>
                <data android:host="cloud.reolink.com"/>
                <data android:pathPrefix="/ulink/smarthome/alexa/"/>
            </intent-filter>
            <intent-filter>
                <action android:name="android.intent.action.VIEW"/>
                <category android:name="android.intent.category.DEFAULT"/>
                <category android:name="android.intent.category.BROWSABLE"/>
                <data android:scheme="reolinksmarthome"/>
                <data android:host="apis.reolink.dev"/>
                <data android:host="cloud.reolink.review"/>
                <data android:host="cloud.reolink.com"/>
                <data android:pathPrefix="/ulink/smarthome/alexa/"/>
            </intent-filter>
        </activity>

If you check it in AndroidManifest, Alexa ToSmart Home Activity has all the exported=true properties, deep links, and app links.

If you look more closely at Alexa ToSmart Home Activity's Uriparse section

String valueOf = String.valueOf(intent != null ? intent.getData() : null);
        BCLog.d(TAG, "url " + valueOf);
        this.code = Uri.parse(valueOf).getQueryParameter(TombstoneParser.keyCode);
        this.state = Uri.parse(valueOf).getQueryParameter("state");
        this.clientId = Uri.parse(valueOf).getQueryParameter("client_id");
        this.redirectUri = Uri.parse(valueOf).getQueryParameter("redirect_uri");
        this.scope = Uri.parse(valueOf).getQueryParameter(PermissionsResponse.SCOPE_KEY);

You can see that you are receiving the factor redirect_uri as the getQueryParameter.

If you look at the init function part of this activity

if (!AccountManager.getInstance().isLogin()) {
            startActivity(new Intent(this, (Class<?>) LoginActivity.class));
            return;
        }
        if (!AccountManager.getInstance().getIsHasAccountData()) {
            BCLog.e(TAG, "no account data, refresh account");
            BCToast.showToast(this, R.string.common_failed_to_get_info);
            AccountManager.getInstance().refreshAccount(new AccountManager.RefreshAccountDelegate() { // from class: com.android.bc.account.smart.AlexaToSmartHomeActivity$initView$4
                @Override // com.android.bc.account.AccountManager.RefreshAccountDelegate
                public void onFail() {
                }

                @Override // com.android.bc.account.AccountManager.RefreshAccountDelegate
                public void onSuccess() {
                    if (AccountManager.getInstance().isEmailVerified()) {
                        return;
                    }
                    BCLog.e(AlexaToSmartHomeActivity.TAG, "not verify email");
                    String name = VerifyEmailFragment.class.getName();
                    Intrinsics.checkNotNullExpressionValue(name, "getName(...)");
                    RouterLaunch.gotoBlank(name);
                }
            });
        } else {
            if (AccountManager.getInstance().isEmailVerified()) {
                return;
            }
            BCLog.e(TAG, "not verify email");
            String name = VerifyEmailFragment.class.getName();
            Intrinsics.checkNotNullExpressionValue(name, "getName(...)");
            RouterLaunch.gotoBlank(name);
        }

Make sure you're logged in and checked your email, and if you are