OAuth — Missing State Parameter (Account Takeover)

ConnectApp lets users link their Twitter account via OAuth. The client never sets the 'state' parameter on the authorization request — and never verifies it on the callback. Use that to link the victim's session to YOUR Twitter account.