Account Takeover via Facebook Oauth

What is Oauth?

Have you ever seen a webpage where you can register via Facebook or Google or any other service? If yes, then you already know the use of OAuth.
In simple terms, Oauth is functionality in web applications that allows users to register or login via a third-party website(example: Facebook, Google, Apple,Twitter, etc)

How it works?

Here is one simple example of demonstrating the working of OAuth:
So whenever you click on “Login with Facebook” or anything else, this is what happening

behind the scenes:
1- The Web application sends a request to the server(let’s say google.com).
2- The user then clicks on his/her google account.
3- The google server verifies the credentials and sends an access token code back to the web application.
4- The web application verifies the token and finally you get logged in or registered. (This is where I found the vulnerability)

So that’s all about Oauth…if you want to know more about OAuth, please visit the link below..I am not going to explain a lot about OAuth since it will it will increase the length of this article.