PKCE downgrade on public OAuth clients

Jul 23, 2026 · 1 min read

PKCE binds the code to a verifier only if the server enforces it. Test whether it accepts a code with no code_verifier, or with method plain, defeating the protection for legacy clients.

bash

# request without PKCE
curl -s https://as/token -d "grant_type=authorization_code&code=$CODE&client_id=CID&redirect_uri=..."
# or with method=plain and a guessed verifier
curl -s https://as/token -d "...&code_verifier=$CHALLENGE"

Confirm which forms yield a token.

bash

for m in none plain; do try $m; done   # any success is a downgrade

Pro note: pair a PKCE downgrade with a code leak (open redirect, referer, mix-up) for account takeover on mobile and SPA clients. The server should reject any code that was issued with a challenge but redeemed without a matching S256 verifier.