Lab: Stealing OAuth access tokens via an open redirect
Summary: PortSwigger's lab demonstrates an OAuth flaw in which the service's validation of the redirect_uri parameter is weak enough to allow directory traversal, letting an attacker point the redirect at an open redirect on the blog website. By chaining the two, an attacker can leak a victim's access token, which appears in the URL as a fragment, to an arbitrary page and use it to obtain the admin user's API key.
Why it matters: The admin account in the lab always holds an active OAuth session and will open anything sent from the exploit server, so a single crafted link is enough to hand over a token that reaches the admin's API key - a reminder that redirect_uri validation and open redirects are the same attack surface when tokens travel in URL fragments.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026