From Redirect to Hijack: Chaining OIDC Misconfigurations for Token Theft
This post, written by Brian, Security Consultant at Secora Consulting, describes how a weakness in an OAuth/OpenID Connect login flow let him turn a redirect issue into session hijacking, based on his own firsthand experiences. During a web application penetration test , I found what initially looked like a standalone redirect validation issue in an OAuth/OpenID Connect (OIDC) login flow. Digging further into the authorisation flow revealed that this validation weakness was only the starting point of a larger problem.