Lab: Authentication bypass via OAuth implicit flow
Summary: This PortSwigger lab demonstrates an OAuth login flow in which flawed validation by the client application lets an attacker log in to other users' accounts without knowing their passwords. The exercise asks the participant to log in to the account of a user named Carlos, whose email address is carlos@carlos-montoya.net, using the supplied credentials wiener:peter for their own social media login.
Bottom line: The weakness sits in the client application's validation, not in the OAuth service, so an attacker who can reach that step needs no password at all to take over another user's account.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026