| name | web-oauth |
| description | Attack OAuth 2.0 / OIDC / SSO flows for account takeover. Load on "Login with Google/GitHub", /authorize, /callback, redirect_uri, state, code/token params, SAML/OIDC SSO. Signals: OAuth endpoints, redirect_uri handling, missing state, implicit flow, pre-account-linking.
|
| domain | web |
| type | technique |
| stability | learning |
| modes | ["bugbounty"] |
| severity | critical |
| owasp | ["A07:2021-Auth-Failures"] |
| cwe | ["CWE-287","CWE-601"] |
| tools | ["burp"] |
| schema_version | 1 |
OAuth / OIDC / SSO abuse
When it applies
The app delegates auth via OAuth/OIDC (social login, enterprise SSO). Flaws here are frequently
full account takeover.
Why it works
OAuth security depends on strict validation of redirect_uri, state, code binding, and how
identities are linked. Implementations relax one of these — and the token/code that proves
identity leaks to the attacker or an account gets linked to the wrong user.
Method
- redirect_uri validation: try appended paths,
//evil, @, subdomain/suffix tricks,
open-redirect on an allowed host (→ web-open-redirect) to exfiltrate the code/token.
- state / CSRF: missing or unvalidated
state → login CSRF / force-link the victim to your account.
- Account linking / pre-takeover: sign up with the victim's email pre-verification, or link
a social account to an existing local account by email without proof → ATO.
- Token/flow issues: implicit-flow token in URL/referrer leak;
code reuse/no PKCE; ID-token
email_verified trust; audience/issuer not checked; mixing providers.
- Steal & replay: capture leaked
code/token, complete the flow as the victim.
Gotchas
- Most impact rides on a
redirect_uri weakness or open redirect on an allowlisted host — chase that first.
- "email_verified: false" trusted by the app is a classic pre-account-takeover.
- Keep it your own test accounts; prove ATO against an account you control on both sides.
Verify success
You authenticate as (or link/hijack) a victim account — e.g. captured code completes login as
the victim, demonstrated with two accounts you own.
References
PortSwigger OAuth labs; RFC 6749/6819; "OAuth security" (Salt/PortSwigger write-ups).
