In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our application where all users who have records in the active directory and "master" database but not yet registered in the app would be sent sms with a registration link. The details are the ff.
A static link is sent (not the usual dynamic ones where a token is appended to the url)
When that link is clicked, an authentication page would show up in the machines internet browser and show a page where it asks for the user's company ID and birthday. When the entered information is valid, a one time password is sent via sms and if valid, the user can now proceed with registration
The question is, is this kind of process secure? there was a debate within our team whether the link sent via sms should be dynamic or static? what are the possible vulnerabilities of this kind of process? doesn't seem to violate any OWASP standard.
Edited: fields in the input page are the user's company id and date of birth