Universal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in...
summary
Finds two concrete platform-wide exploits: COAT (Cross-app OAuth Account Takeover) and CORF (Cross-app Request Forgery), plus a semi-automated tester COVScan that probes OAuth flows. On 18 popular integration platforms the authors report 11 COAT cases and 5 CORF cases (including Microsoft, Google, Amazon), nine platforms allow one-click compromises, and one vulnerability earned a CVE with CVSS 9.6. Fixes require embedding and cross-checking an app-specific ID in both state and redirect_uri; an IETF draft is published.
AI-written summary · about
chapters (14)
- 0:00OAuth 2.0 in integration
- 4:04Account linking workflow
- 6:06Cross-app attacks: CULT & CORF
- 8:57Active app tracking flaws
- 10:02CULT attack explained
- 11:55CORF attack explained
- 13:22Defending with app ID tracking
- 14:26Vulnerability testing approach
- 15:29COVESCAN results
- 16:54PKCE & MixUp defenses limits
- 19:42MixUp defense limitations
- 21:07OAuth 2.0 spec changes
- 22:09Key takeaways
- 23:13Q&A
related talks
47mTop X OAuth 2 Hacks
36mHow To Hack OAuth｜
18mHow to Hack OAuth
47m1000 Ways to Die in Mobile Oauth
48mThe Accidental Discovery of a New Vulnerability in Google's OAuth Implementation
27mSecurity Issues In OAuth/OIDC Implementations
47mHacking OAuth
01h 02mOpenID Connect & OAuth 2.0 – Security Best Practices