When “Safe” Isn’t Safe: Turning a Simple HTML Injection into a Real Security Story.

A bug bounty write-up detailing the discovery of a Reflected HTML Injection vulnerability on an SSO authentication endpoint. The client_id parameter was reflected in the HTML response without output encoding, allowing arbitrary HTML rendering. While XSS payloads were blocked, the vulnerability still poses real risk through phishing and social engineering on a trusted auth domain. Remediation includes output encoding, allow-list validation for client_id, and implementing a Content Security Policy.