OAuth Misconfiguration: How I Hijacked Accounts with 0 Clicks and Got Paid!

Free Article Link: Here!!!!

So, there I was, scrolling through my targets when I stumbled upon a juicy-looking app. You know, one of those “Log in with Oauth” buttons slapped all over the place. I thought, “Hmm, let’s take this OAuth flow for a spin.” Spoiler alert: things went *very* wrong (for them, not for me). 😂😎

How I figure out the vulnerability

OAuth was being misused in this app. Instead of checking if the OAuth token actually belonged to the user logging in, the app was accepting any valid token from the service. Yeah, you read that right. Any. Token. Basically, I could be logged into one account and steal another user’s account without lifting a finger (or clicking a button).

0 Click Account Takeover

I didn’t need phishing, brute-forcing, or fancy payloads. All I needed was the token and their poor OAuth validation. The impact? Full access to accounts. That’s right passwords, personal data, account settings everything I can access.