---
id: 5669
title: "How we broke exchanges: a deep dive into authentication and client-side bugs"
source_domain: osec.io
source_url: "https://osec.io/blog/how-we-broke-exchanges-oauth-misconfigurations/"
published_at: "2025-10-16T12:00:00Z"
tags: ["web3", "account-takeover", "authentication", "vulnerability", "oauth", "exchanges"]
phying_url: "https://phying.com/item/5669"
lang: en
---

# How we broke exchanges: a deep dive into authentication and client-side bugs

## Summary

OtterSec details OAuth misconfigurations that lead to account takeover in exchanges, SDKs and wallets, including Google GSI/FedCM flow quirks and desktop-vs-mobile environment gaps.

## Intelligence Metadata

- **Sources:** osec.io
- **Published:** 2025-10-16T12:00:00Z
- **Original:** https://osec.io/blog/how-we-broke-exchanges-oauth-misconfigurations/
- **Phying News:** https://phying.com/item/5669