Got Nice catch by Google
Target Program: Google
🎯 Vulnerability: OAuth 2.0 / JWT Authentication Bypass
💡 Defense Fix: Strictly verify JWT signatures on the backend, enforce state parameter validation, and reject 'alg: none'.
More Writeups Like This
pentester.land
by Mosaad Sallam (@h0tak88r), Mohamed Walid (@L0daW)AI Under Siege: Discovering and Exploiting Vulnerabilities
pentester.land
by Tommaso Innocenti (@innotommy), Matteo Golinelli, Kaan Onarlioglu, Ali Mirheidari, Bruno Crispo, Engin KirdaOAuth 2.0 Redirect URI Validation Falls Short, Literally
pentester.land
by Mohamed Lakhdar Metidji (@minometidjii)OAuth 2.0 Authentication Misconfiguration
pentester.land
by Aviad Carmel (@AviadCarmel)