Popular URL Shortener 'Bitly' User Accounts Reportedly Compromised

The famous URL shortening service is facing a data breach. The very popular URL shortening service Bitly, has issued an urgent security warning saying that its users’ account credentials may have been compromised, according to a blog post published yesterday. "We have reason to believe that Bitly...

For the recent Bosch global eye OAuth vulnerability analysis and preventive recommendations-vulnerability warning-the black bar safety net

According to CnetreportsSingapore Nanyang Technological University, a man named Wang Jing PhD student, found that the OAuth and OpenID open source login tools the“covert redirect”vulnerabilityCovert Redirect to. First of all need to clear point is that the vulnerability is not present in the OAut...

Nasty Covert Redirect Vulnerability found in OAuth and OpenID

After Heartbleed bug, a security flaw in widely used open-source software OpenSSL that puts countless websites at risk, another vulnerability has been found in popular authentication software OpenID and authorization software OAuth. Wang Jing, a Chinese mathematics Ph.D student at the Nanyang...

CVE-2013-6738

Cross-site scripting XSS vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint...

CVE-2013-6738

Cross-site scripting XSS vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint...

Respondly: OAuth Bug

I read the bug of @melvin and I also try to bypass this https://app.respond.ly/oauth/twitter/?requestTokenAndRedirect=https://hackerone.com so I made a bypassing tehcnique but didnt work https://app.respond.ly/oauth/twitter/?requestTokenAndRedirect=//hackerone.com But I think I found a bug This i...

Google Recommends Developers Support OAuth 2.0

Google announced today that in the coming months it will be more stringent in securing users when they log in to their accounts by applying additional authorization checks. “These additional checks will ensure that only the intended user has access to their account, whether through a browser,...

Respondly: OAuth open redirect

An attacker can use an open redirect vulnerability in the Twitter OAuth process to redirect someone to his/her webpage, while also obtaining the OAuth token and verifier of the victim. The vulnerability is right here:...

Slack: Facebook Takeover using Slack using 302 from files.slack.com with access_token

Hi, I noticed that your Facebook application used in the "Import Photo" can be used to take over the Facebook account of the user being attacked. It's multiple issues in one: 1. You have a 302 redirect from a .slack.com domain. Hash-values will follow the redirect. 2. The Facebook application OAu...

Coinbase: Coinbase Android Application - Bitcoin Wallet Leaks OAuth Response Code

Hi, There's a simple bug here, the Coinbase Android App. "BitCoin Wallet" leaks the OAuth Response Code which can be obtained using adb logcat -s Coinbase command line for testing, and any Android application on the same phone can read the response code for the user by reading the logs. As of now...

Phabricator: OAuth Stealing Attack (New)

Hi Evan, I found a new and more dangerous way to steal phabricator facebooks oauth tokens,codes, In this case, I exploited the behavior of Phabricator OAuth Dialog, If you provide a differnet scope in phabricator OAuth Dialog...

Coinbase: Coinbase Android Security Vulnerabilities

My name is Bryan Stern and I am Android Software Engineer. Last night I took another look at your Android application and found some disturbing vulnerabilities that could allow for a user's account to be hijacked. Fortunately, they are very easy to resolve. Below I have outlined the issue, gave...

Phabricator: OAuth access_token stealing in Phabricator

Hi, I found that an attacker is able to steal accesstokens of facebook users via Phabricator App 184510521580034. when users login to phabricator, they can choose to login via Facebook https://secure.phabricator.com/login/ attaching pic, In this case an attacker is able to exploit this behavior t...

Slack: State parameter missing on google OAuth

Hi, State parameter i.e anti-csrf token to prevent session hijacking attacks is missing on Google OAuth i.e...

Slack: Broken Authentication (including Slack OAuth bugs)

Hi, Hope you are doing good! Please have a look at the below report. Description: OAuth Framework Flaw Bypassing redirecturi validation An attacker to exploit this Flaw just needs to find a open redirection flaw in the site which is using Slack's OAuth for logins. Impact: A malicious user can ste...

Phabricator: Login CSRF using Twitter OAuth

This bug is related to bug report 774 Log in a user to another account by @dawidczagan as this bug also allows a user to be logged in as the attacker. The main reason is that no state is maintained in the authentication flow. Although the Twitter flow still uses OAuth 1.0A, which has no state...

Five OAuth Bugs Lead to Github Hack

A Russian security researcher was able to take five low severity OAuth bugs in the coding site Github and string them together to create what he calls a “simple but high severity exploit” that gave him unfettered access to users’ private repositories. Bangkok-based researcher Egor Homakov –...

CVE-2013-7142

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified oAuth API functions...

Cross site scripting

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified oAuth API functions...