Lab: SSRF via OpenID dynamic client registration
Summary: PortSwigger's lab demonstrates SSRF through an OAuth service's dynamic client registration endpoint, where client-supplied data such as the logo_uri property is used unsafely by the provider. The exercise requires crafting a POST /reg request with a redirect_uris array to register a fake client, then pointing logo_uri at http://169.254.169.254/latest/meta-data/iam/security-credentials/admin/ to steal the secret access key for the OAuth provider's cloud environment.
What you should know: A registration field meant for a client's logo is enough to reach the cloud instance metadata endpoint and pull IAM credentials for the OAuth provider's environment - the same metadata path that sits behind many cloud breaches.
Read the original at PortSwigger Research ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026