A one-click vulnerability is a security flaw that can be triggered by a single user action, such as clicking a link, opening a message, or tapping a button. The action may look harmless, but it can activate hidden logic in a web app, client, or connected service and cause the system to do something the user did not intend.
These flaws matter because they lower the attacker’s effort dramatically: no password theft, no complex exploitation chain, just one convincing interaction. In real attacks, one-click bugs are often used for account abuse, unauthorized data access, session manipulation, or prompt injection against AI assistants that already have permissions. Defenses focus on reducing what a single click can do: require stronger confirmation for sensitive actions, limit delegated permissions, validate redirects and actions server-side, and monitor for unusual access after user interaction. Security teams should treat any feature that can reach other services from an authenticated session as part of the attack surface.