#vulns.co
/
mcp by GKData.io

← Back to Payloads

OAuth / OIDC

redirect_uri tricks, implicit flow, mixed response_type, state CSRF. Pair with the OAuth playbook.

Tags: oauth, oidc, ato

Controlled probes

  • redirect_uri=https://target.com.evil.example
  • redirect_uri=https://target.com/callback/../../
  • redirect_uri=https://target.com%40evil.example
  • response_type=token
  • response_type=id_token token
  • state=  (empty / missing)

Source: https://portswigger.net/web-security/oauth

← Back to Payloads