---
id: 5675
title: "Subverting Web2 authentication in Web3"
source_domain: osec.io
source_url: "https://osec.io/blog/subverting-web2-authentication-in-web3/"
published_at: "2025-03-07T00:00:00Z"
tags: ["web3", "authentication", "vulnerability", "oauth", "supabase", "web3auth"]
phying_url: "https://phying.com/item/5675"
lang: en
---

# Subverting Web2 authentication in Web3

## Summary

OtterSec examines hidden risks in Web3 apps using Web2 auth: an OAuth logic flaw in Web3Auth, a Supabase user_metadata misconfiguration, and OAuth abuse in localhost setups.

## Intelligence Metadata

- **Sources:** osec.io
- **Published:** 2025-03-07T00:00:00Z
- **Original:** https://osec.io/blog/subverting-web2-authentication-in-web3/
- **Phying News:** https://phying.com/item/5675