BB Day18: OAuth 2.0 Bug Bounty 2026 — CSRF in OAuth, Token Leakage & Account Takeover Chains

This article teaches OAuth 2.0 vulnerability testing for bug bounties, focusing on four critical attack classes: missing state parameters enabling CSRF, redirect_uri validation bypasses allowing code theft, token leakage via Referer headers, and account takeover chains combining these weaknesses. The material matters because OAuth flaws consistently pay Critical severity in bug bounty programs and affect nearly every modern application with social login functionality.

• OAuth authorization code flow attack surfaceThe OAuth flow involves four entities (user, client application, authorization server, resource server) communicating through three browser-interceptable steps: the authorization request with client_id, redirect_uri, and state parameters; the authorization code return in the callback URL; and the token exchange validation. Each step presents distinct testing vectors—redirect_uri and state in Step 1, code in the URL in Step 2, and redirect_uri matching in Step 3.
• Missing state parameter enables CSRF account takeoverWithout a state parameter, an attacker can initiate an OAuth flow with their own account, capture the authorization code in the callback URL, send that URL to a victim via phishing or CSRF, and when the victim clicks it, the victim's account becomes linked to the attacker's OAuth identity. The attacker can then log in as the victim using their own OAuth credentials, achieving full account takeover without the victim's password.
• State parameter validation must be checked thoroughlyMerely checking for state presence is insufficient—the article demonstrates that a real-world vulnerability involved a state parameter that was static rather than randomly generated. The article requires testing three conditions: state must exist, must change each time (randomly generated), and must be tied to the user's session. Testing involves modifying the state value in the callback and checking if the application accepts tampered values.
• Redirect URI validation bypass patternsSeven distinct redirect_uri bypass patterns can redirect authorization codes to attacker-controlled destinations: path traversal (callback/../attacker.com), query string injection (callback?x=attacker.com), subdomain matching (attacker.app.com), @ character confusion (app.com@attacker.com), URL encoding variations, extra slashes, and localhost bypass. Testing each systematically in Burp Repeater reveals authorization servers that validate domain but not path, or fail to validate specific bypass techniques.
• Token leakage through Referer header to third partiesWhen authorization codes or access tokens appear in callback URLs and the page loads third-party resources (analytics, CDN, fonts, ads), the browser automatically sends the full URL including credentials in Referer headers to those third parties. Detection involves checking whether code= appears in the callback URL and whether third-party scripts load after OAuth completion, indicating silent credential theft without requiring interception tools.
• Implicit flow exposes tokens directly in URLThe implicit flow with response_type=token places access tokens directly in the URL fragment rather than issuing an authorization code. While fragments technically do not send in Referer headers, the article warns that JavaScript can read location.hash and leak credentials via postMessage or window.open calls, making implicit flow inherently more dangerous than the authorization code flow.
• Complete account takeover chain requires multiple weaknessesFull account takeover combines redirect_uri bypass (to steal the authorization code), missing state or weak state validation (to force a victim into the OAuth flow), and successful code exchange (to log in as the victim). The article emphasizes that each step amplifies the others—code theft alone is insufficient without forcing a victim into the flow, and CSRF alone is insufficient without a way to access the victim's account.
• Practical OAuth testing workflow and escalationThe article prescribes a three-step testing sequence: first map the OAuth flow using browser DevTools to identify all parameters and third-party scripts; second, test for missing or weak state parameter using Burp Repeater to modify callback values; third, test redirect_uri validation by systematically trying seven bypass patterns. The article includes three hands-on exercises—browser-based parameter mapping, PortSwigger lab exploitation, and Burp Intruder payload testing—to demonstrate real-world exploitation.

Bottom line: OAuth vulnerabilities—particularly missing state parameters, redirect_uri validation bypasses, and token leakage—are consistently Critical severity findings in bug bounties because they enable direct account takeover without requiring victim passwords. Testing requires systematic parameter analysis, validation bypass attempts, and Referer header inspection combined into a complete exploitation chain demonstrating how weaknesses compound into full compromise.