AuthenticationHighOAuth/OIDC misconfiguration

OAuth Issues

Misconfigured OAuth flows leak tokens or allow account takeover via redirect, state, and code handling flaws.

Overview

Loose redirect_uri matching, missing state (CSRF), code/token leakage via open redirects or referer, and implicit-flow misuse let attackers steal authorization codes or tokens and link accounts.

How it works

Loose redirect_uri matching, missing state (CSRF), code/token leakage via open redirects or referer, and implicit-flow misuse let attackers steal authorization codes or tokens and link accounts.

Example

http

GET /authorize?...&redirect_uri=https://evil.tld   # accepted -> code/token theft

Impact

Account takeover, token theft, and identity linking abuse.

Detection

Test redirect_uri validation, state presence/binding, PKCE enforcement, and token leakage paths.

Prevention

Exact-match registered redirect_uris; no wildcards.
Require and bind a state parameter; enforce PKCE for public clients.
Use the authorization-code flow, short-lived codes, and avoid leaking tokens in URLs.