Hidden OAuth attack vectors

Summary: PortSwigger researcher @artsploit published three new OAuth2 and OpenID Connect vulnerability classes on 24 March 2021: SSRF through Dynamic Client Registration, redirect_uri session poisoning, and WebFinger user enumeration, demonstrated against ForgeRock OpenAM and MITREid Connect. In MITREid Connect, the /register endpoint does not check the current session, and the logo_uri parameter is fetched server-side by the getClientLogo controller without verifying the content is an image, allowing SSRF and XSS on the authorization server domain.
Bottom line: The registration endpoint is standardized, so these second-order SSRF flaws can be found even in black-box testing, and a single malicious logo_uri can execute JavaScript inside your authorization server's domain.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026