Скачать или смотреть OAuth Misconfiguration Vulnerability | Bug Bounty Poc

Hello All,

Vulnerability Name: OAuth Misconfiguration Vulnerability
Severity: P2 (High)

Vulnerability Description:
This application has a weak auth verification that does not check if a the previous account was created with the same email when we use google to login into our accounts. So, basically what it means is that someone can register using the unregistered victim's account. after that victim will log in using the OAuth. in this case, the verification the process is bypassed and the attacker can log in using the password after that.

Impact :
Only one thing we need here and that is an email address. Just by knowing that we can take over the victim's account so the impact here is quite high. Imagine email address is something you can even get if you ask so it's not a hard task. But since the OAuth does not authenticates the real user attackers can easily take over the account.

Thanks for watching :)