Skip to content
-
Cross-subdomain cookie theft via scoping
A session cookie scoped to the parent domain is readable and settable by any subdomain, including one you can control.
Auth & Tokens
-
OAuth device code phishing
Start a device authorization flow and get the victim to approve your code, yielding tokens for their account.
Auth & Tokens
-
Predictable password reset tokens
Reset tokens derived from time, user id, or a fast RNG can be predicted or brute forced within the validity window.
Auth & Tokens
-
Session fixation across the login boundary
If the session id is not rotated on authentication, an attacker who plants a known id before login rides the victim's session after.
Auth & Tokens
-
2FA bypass through flow and response manipulation
Test skipping the OTP step, replaying a success response, and whether backup codes or remember-me tokens are weaker.
Auth & Tokens
-
SAML NameID comment injection
A comment inside the signed NameID can make the app read a different identity than the one the signature covered.
Auth & Tokens
-
SAML signature wrapping (XSW)
Move the signed assertion aside and inject an unsigned one so the verifier checks the original but consumes yours.
Auth & Tokens
-
PKCE downgrade on public OAuth clients
If the token endpoint still accepts a plain or absent code_verifier, an intercepted code is redeemable without the secret.
Auth & Tokens
-
OAuth redirect_uri and response_type juggling
Loose redirect matching or switching to the token response type can leak the authorization code to an attacker URL.
Auth & Tokens
-
JWT kid injection to path traversal or SQL
The kid header often indexes a key by file path or database row, so it inherits traversal and SQL injection.
Auth & Tokens