Skip to content
Hidden OAuth attack vectors
portswigger.net | research | #user-enumeration | #ssrf | #oauth | #openid-connect | #webfinger | #session-poisoning
Summary
Three new OAuth2/OpenID Connect vectors — Dynamic Client Registration SSRF by design, redirect_uri session poisoning, WebFinger user enumeration — shown on ForgeRock OpenAM and MITREid Connect.
- Published
- Collected