OAuth and OIDC

Playbooks

• OAuth & SSO Misconfiguration - Abuse loose redirect and state handling in OAuth flows to steal tokens and take over accounts.
• Open Redirect Chains - Do not report the bounce. Report where the victim's code, token, or script execution goes.

Gadgets

• Open redirect - Low alone. High when it leaks an OAuth code, a session token, or feeds a server-side fetch.
• Leaked token in URL, JS, or Referer - A password-reset or OAuth token in a URL is an ATO gadget if it is reusable, long-lived, or logged.
• Framable authenticated page - Usually P5. Becomes real when a sensitive state-changing UI is framable (disable 2FA, OAuth approve, delete, wire).
• OAuth redirect_uri mismatch - A loose redirect_uri is an ATO gadget. This is one of the highest-converting chains on SSO-heavy programs.
• Well-known / security.txt / OIDC discovery - Recon only, unless a key or an admin panel is sitting there.
• Email / SMS parser confusion - Register victim@target.com as victim@target.com@attacker.com, or use unicode dots, or plus-tags, depending on what the IdP vs the app vs the mailer treat as the same mailbox.

Payloads

• Open Redirect - Escape allow-list redirect validation. Low impact alone, but chains into OAuth token theft and SSRF filter bypass. Test on redirect_uri, next, returnUrl, url, and dest params.
• OAuth / OIDC - redirect_uri tricks, implicit flow, mixed response_type, state CSRF. Pair with the OAuth playbook.

Bypasses

• OAuth redirect_uri / flow tricks - Allowlists that are string-prefix checks, leftover implicit flow, and open redirects on an allowed origin.

Checklists

• Authentication / ATO - Account takeover is a chain. Inventory every step of how an identity becomes a session.

Questions

Is an open redirect on the IdP enough?

It is a gadget. It becomes ATO when the authorization code or token lands on an origin you control.

What about state?

Missing or predictable state is login CSRF on SSO. Pair it with a redirect_uri issue before you call it ATO.

This page is the public form of hunt_brief("oauth") on the MCP connector. Authorized testing only.