Top X OAuth 2 Hacks

on YouTube ↗47m

" summary

Concrete OAuth 2 implementation bugs are analyzed: reused authorization codes enabling replay/token theft, open redirect plus improper redirect-URI validation allowing attacker-registered clients to capture auth codes, and putting access tokens in URLs (leaking via logs/Referer). The talk cites real incidents affecting Facebook, Google, Microsoft, GitLab, PayPal and Dropbox and shows exploits using whitelist quirks, URI spoofing and DNS/localhost tricks; recommended fixes are exact redirect-URI matching and never placing tokens in URLs.

AI-written summary · about

" chapters (13)

1. 0:00Introduction
2. 2:07Why OAuth 2 was created
3. 8:31OAuth 2 flaws and IETF decisions
4. 17:27OAuth 2 is not auth
5. 22:07Reusing authorization code
6. 24:12Open redirect and attacks
7. 29:17Native app errors and client flow
8. 32:07Access token in URL risks
9. 34:17CSRF and related attacks
10. 37:12OAuth 2 as auth misuse
11. 39:40Advanced redirect URI attacks
12. 44:03Secure OAuth 2 tips
13. 45:08Q&A

" related talks

• 36mHow To Hack OAuth｜Aaron Parecki · Øredev 2019
• 47mHacking OAuthAaron Parecki · Developer Summit 2020
• 18mHow to Hack OAuthAaron Parecki · GOTO Chicago 2020
• 23mUniversal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in...Wing Cheong Lau, Kaixuan Luo, Xianbo Wang, Pui Ho Adonis Fung, Julien Lecomte · USENIX Security '25
• 37mHacking OAuth Pitfalls and RemediesMicah Silverman · Devnexus 2021
• 01h 02mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Oslo 2020
• 47m1000 Ways to Die in Mobile OauthShuo Chen, Eric Chen, Yuan Tian, Yutong Pei, Robert Kotcher, Patrick Tague · Black Hat USA 2016
• 01h 00mBreaking and securing OAuth 2.0 in frontends at NDC SecurityPhilippe De Ryck · NDC Security 2025