pentester.land· Nov 5, 2019· by Teddy Katz (@not_aardvark)💰 Bounty: 25,000

Bypassing GitHub's OAuth flow

Target Program: GitHub

🎯 Vulnerability: OAuth 2.0 / JWT Authentication Bypass

💡 Defense Fix: Strictly verify JWT signatures on the backend, enforce state parameter validation, and reject 'alg: none'.

#OAuth#Authorization bypass