OAuth
InformationalOAuth 2.0
Definition
OAuth 2.0 is an authorization framework that lets third-party applications obtain limited access to a user's resources on another service without sharing credentials. It uses flows such as Authorization Code, Implicit and Client Credentials. Incorrect OAuth implementations are a frequent source of vulnerabilities such as account takeover and token theft.
Impact
Account takeover by stealing the authorization codeAccess token theft via open redirect in redirect_uriUnauthorized access to user data on third-party servicesCSRF in the OAuth flow to link the attacker's accountPrivilege escalation by manipulating scopes
Examples
Authorization Code theft via a tampered redirect_uri
If the OAuth authorization server does not strictly validate the redirect_uri (allowing subdomains, arbitrary paths or lookalike domains), the attacker can redirect the authorization code to their own server, gaining access to the victim's account.
# Normal OAuth flow: GET /authorize?response_type=code &client_id=app123 &redirect_uri=https://app.com/callback &scope=email &state=random123 # Attack: tamper with redirect_uri GET /authorize?response_type=code &client_id=app123 &redirect_uri=https://app.com.evil.com/callback &scope=email &state=random123 # If the OAuth server does not strictly validate redirect_uri, # the authorization code is sent to the attacker's domain