Doorkeeper gem does not revoke tokens & uses wrong auth/auth method

Doorkeeper failed to implement OAuth 2.0 Token Revocation RFC 7009 in the following ways: 1. Public clients making valid, unauthenticated calls to revoke a token would not have their token revoked 2. Requests were not properly authenticating the client credentials but were, instead, looking at th...

Instacart: API OAuth Public Key disclosure in mobile app

Our Android/iOS app can be decompiled and the OAuth Public token can be accessed. Contrary to Instacart's summary, the API private key is also leaked, allowing anyone to use Instacart's private API without restriction. Instacart which I have found to be great in general ignored my additional...

QIWI: [qiwi.com] Oauth захват аккаунта

CSRF in implementation of oAuth protocol allows attackers takeover the account of any user. CSRF in implementation of oAuth protocol allows attackers takeover the account of any user...

The vulnerability of the WebSphere Application Server software allows a malicious intruder to compromise the integrity of protected information.

XSS attacks in IBM SmartCloud Analytics Log Analysis allow malicious actors to inject arbitrary web scripts or HTML code by using an invalid request parameter in the response from the final authentication endpoint of OAuth...

Native applications with OAuth 2

By Justin Richer and Antonio Sanso This article was excerpted from the book OAuth 2 in Action. The OAuth core specification specifies four different grant types: Authorization Code, Implicit, Resource Owner Password Credentials and Client Credentials. Each grant type is designed with different...

Heroku the latest vulnerability to cause the hackers can take control of their accounts-vulnerability warning-the black bar safety net

Premise Description: 5 month 2 6 day, the vulnerability has been fixed. Environment Heroku（https://www.heroku.com/there is one called“one click deployment”feature, when you click, it is possible to achieve a bond of the configuration and deployment of third-party components, libraries and...

Shopify: Authentication Bypass on Icinga monitoring server

An Icinga monitoring server, which was intended to be accessible only by Shopify employees, had Google OAuth misconfigured such that all Google accounts were accepted regardless of whether they belonged to the shopify.com hosted domain or not. The server has been reconfigured to validate the hd...

Gratipay: configure a redirect URI for Facebook OAuth

Hey, Its me again. since the Login with Facebook doesnt have a dedicated directory like gratipay.com/facebook/callback it is possible to still steal access tokens...

Dropbox client - Multiple Vulnerabilities - SA-CONTRIB-2016-027

This module enables you to view dropbox files in your Drupal site. The module doesn't sufficiently sanitize filenames when displaying them to users or administrators leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must be able to...

Holy redirect_uri Batman!

If you bought the book I have been writing with Justin Richer namely OAuth 2 in Action you might have noticed that we will never got tired to stress out how much important the redirecturi is in the OAuth 2 universe. Failing to understand this rather simple concept might lead to disasters. The...

Vimeo: OAuth 2 Authorization Bypass via CSRF and Cross Site Flashing

Hello Vimeo Security Team, There is a vulnerability in api.vimeo.com/oauth which allows an attacker to gain full App privilege over a Vimeo victim user account without user approval, just by having the victim open a link to the attacker webpage. Proof of Concept link :...

Moneybird: Employees with Any Permissions Can Create App with Full Permissions and Perform any API Action

By changing the POST parameters of an OAuth authentication call, it was possible to get full permissions to an administration for which the user has limited access. With the fix in place, access will be denied when the administration id is changed...

Moneybird: Content Spoofing In Moneybird

Reporter found a content spoofing vulnerability in an OAuth related endpoint that reflected custom text present from the URL in the body. We have taken measurements to prevent this problem in the future...

X (Formerly Twitter): [Critical] - Steal OAuth Tokens

Hi, This bug is caused because of the same mis-configuration as 128119. Only this time Microsoft Outlook auth is vulnerable instead of Facebook. this time I will try to be as clear as possible. after sign up of Twitter, Twitter asks users to import contacts and it only requires on authorization -...

IBM WebSphere Application Server 7.0 < 7.0.0.41 / 8.0 < 8.0.0.12 / 8.5 < 8.5.5.9 OAuth Provider XSS

The IBM WebSphere Application Server running on the remote host is version 7.0 prior to 7.0.0.41, 8.0 prior to 8.0.0.12, or 8.5 prior to 8.5.5.9. It is, therefore, potentially affected by a reflected cross-site scripting XSS vulnerability due to a failure to properly validate output from the OAut...

Uber three tasteless exploits of magical-vulnerability warning-the black bar safety net

Author through careful design, will be a tasteless self-XSSand two tasteless csrf turned into a high-quality vulnerability. Original: https://fin1te.net/articles/uber-turning-self-xss-into-good-xss/ In Uber a set of personal information on the page, I found a very simple and...

IBM WebSphere Application Server Privilege Escalation Vulnerability (swg21697368)

IBM WebSphere Application Server is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft OAuth interface XSS, affecting user account security-vulnerability warning-the black bar safety net

One day, while I was browsing on Twitter information, I found a very interesting article, Wesley Wineberg in the Microsoft OAuth authentication interface found a CSRF vulnerability. This article makes me curious at the same time also provoked I can be in this place and then find a loophole of fai...

ThisData: Login CSRF using Google OAuth

This bug is related to bug report https://hackerone.com/reports/774 as this bug also allows a user to be logged in as the attacker. An attacker could exploit this bug as follows: Attacker initiates Google OAuth process with thisdata Attacker allows access to thisdata app Attacker records and drop...

X (Formerly Twitter): Bypassing Digits web authentication's host validation with HPP

Hi, I would like to report an issue on Digits web authentication which allows attackers to retrieve the OAuth credential data of an application victims authorized. Detail As described in 108429, the login page has 2 parameters, consumerkey and host. The former identifies which app a user wants to...