OAuth mix-up across authorization servers
Mix-up is a client that supports more than one authorization server and treats their responses as interchangeable. RFC 9207 puts the issuer on the authorization response so the client can reject a mismatch, and a shared redirect endpoint or a state value…
Tags: oauth, oidc, sso, ato
Typical severity: P2-P4
What it becomes
Low alone when the app has one identity provider, and it becomes code theft or account linking when the client does not bind the response to the issuer that started the request.
Where to look
multi-provider loginshared redirect endpointstoken-endpoint selection in the app or its backend
Chains
- Authorization code theft: The client redeems the code at the issuer named by the response rather than the issuer that started the request, so the code and the PKCE verifier are sent to the wrong token endpoint.
- Account linking: A response from one authorization server is accepted as login for another because issuer, audience, and state are not compared to the request that started the flow.
Notes
- Test with identity providers the program gives you, or with two tenants you own. Do not point a production client at an authorization server you do not control.
- A single hard-coded issuer has nothing to mix up. Confirm a second authorization server before you write the report.