How I Hijacked OAuth Tokens Through a Parallel Auth Flow Race Condition — $8500 P1 Bug Bounty 💰
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Anmol Singh Yadav discovered a race condition vulnerability in a cloud-based business management platform’s OAuth 2.0 implementation, allowing him to hijack OAuth tokens. By exploiting parallel authorization flow requests with manipulated state and code_verifier values, he obtained access tokens not tied to his session, leading
Table of contents
How I Hijacked OAuth Tokens Through a Parallel Auth Flow Race Condition — $8500 P1 Bug Bounty 💰Target OverviewWhat is an OAuth Vulnerability?The Flaw: A Parallel Authorization Flow Race ConditionStep-by-Step ExploitationSort: