OAuth/OpenID Connect Flaws
Misconfigured OAuth 2.0 or OpenID Connect implementations can lead to token theft, authorization bypass, account takeover, and privilege escalation. Common flaws include insufficient redirect URI validation, missing state parameters, and improper token handling.
Overview
OAuth 2.0 and OpenID Connect are complex protocols that provide authorization and authentication. Implementation flaws are common and can have severe security implications. Attackers target misconfigured redirect URIs, missing state parameters, token leakage, and improper scope handling to gain unauthorized access.
Types & Variants
Redirect URI Manipulation
Exploiting insufficient validation of redirect URIs to steal authorization codes or tokens.
State Parameter Bypass
CSRF attacks on OAuth flows due to missing or weak state parameter validation.
Token Leakage
Access tokens exposed through URL fragments, referrer headers, or browser history.
Impact
Account takeover, authorization bypass, token theft, privilege escalation, social login abuse.
Remediation
Validate redirect URIs strictly, use PKCE for public clients, implement state parameter for CSRF protection, validate tokens properly, and use short-lived access tokens.
Validate redirect URIs using exact string matching
Always use the state parameter with unpredictable values
Implement PKCE for mobile and single-page applications
Use short-lived access tokens with refresh token rotation
Validate all token claims and scopes
Related SuperClue scanner checks
These scanner checks look for signs of OAuth/OpenID Connect Flaws. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works