---
id: 5483
title: "Hidden OAuth attack vectors"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/hidden-oauth-attack-vectors"
published_at: "2021-03-25T14:49:00Z"
tags: ["user-enumeration", "ssrf", "oauth", "openid-connect", "webfinger", "session-poisoning"]
phying_url: "https://phying.com/item/5483"
lang: en
---

# Hidden OAuth attack vectors

## Summary

Three new OAuth2/OpenID Connect vectors — Dynamic Client Registration SSRF by design, redirect_uri session poisoning, WebFinger user enumeration — shown on ForgeRock OpenAM and MITREid Connect.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2021-03-25T14:49:00Z
- **Original:** https://portswigger.net/research/hidden-oauth-attack-vectors
- **Phying News:** https://phying.com/item/5483