Breaking the Chain: Exploiting OAuth and “forgot password” for account takeover

Published

2024-12-03 13:00

Collected

2026-07-01 13:32

---
id: 693
title: "Breaking the Chain: Exploiting OAuth and “forgot password” for account takeover"
source_domain: bugcrowd.com
source_url: "https://www.bugcrowd.com/blog/breaking-the-chain-exploiting-oauth-and-forgot-password-for-account-takeover/"
published_at: "2024-12-03 13:00"
tags: ["bug-bounty", "burp-suite", "account-takeover", "oauth", "forgot-password", "writeup"]
phying_url: "https://phying.com/item/693"
lang: en
---

# Breaking the Chain: Exploiting OAuth and “forgot password” for account takeover

## Summary

A write-up of two account takeovers shown at Ekoparty 2024: manipulating loginType and oauthId in an OAuth login flow, and abusing a 16-digit code in forgot-password, step by step with Burp Suite.

## Intelligence Metadata

- **Sources:** bugcrowd.com
- **Published:** 2024-12-03 13:00
- **Original:** https://www.bugcrowd.com/blog/breaking-the-chain-exploiting-oauth-and-forgot-password-for-account-takeover/
- **Phying News:** https://phying.com/item/693