OAuth & SSO Misconfiguration
Abuse loose redirect and state handling in OAuth flows to steal tokens and take over accounts.
Every step requires authorization. Review side effects before running commands against a live system.
Map the flow
Capture the full authorization request: client_id, redirect_uri, response_type, scope, and state. Note whether it's implicit (token in fragment) or code flow.
Attack redirect_uri
Test path traversal, subdomain wildcards, open-redirect chains, and appended parameters to exfiltrate the code/token to an attacker-controlled host.
Break state / CSRF
Remove or reuse the state parameter to test login CSRF and account linking (attach your social login to the victim's account).
Steal via referer / leaks
Check if the code/token leaks through Referer headers to third-party resources on the callback page.
Common guidance
- A redirect_uri that allows any subdomain + one open redirect on a subdomain = token theft.
- Pre-account-takeover: register with a victim's email before they do via SSO.
Mapped workflow tools
References
Version history: normalized permanent page created 2026-08-20.