pentester.land· Sep 1, 2024· by Likith Teki💰 Bounty: 250

How I Got $250 For My Second Bug on HackerOne

Open Original Article ↗
Target Program: -
🎯 Vulnerability: OAuth 2.0 / JWT Authentication Bypass
💡 Defense Fix: Strictly verify JWT signatures on the backend, enforce state parameter validation, and reject 'alg: none'.
#OAuth#Session expiration issue

More Writeups Like This

dev.to

Service-to-service auth: clients, audiences, and scopes

by karmadon
medium.com/tag/bug-bounty

Four Redirects, One URL, Full Account Takeover: An OAuth Chain Autopsy

by Raj Namdev
GitHub Repos

playb0t/mcp-remote-oauth-security

by playb0t
medium.com/tag/bug-bounty

An Open Redirect Isn’t a Phishing Bug. It’s a Token Delivery Failure.

by Raj Namdev