OAuth redirect_uri and response_type juggling
Loose redirect matching or switching to the token response type can leak the authorization code to an attacker URL.
Tag: account-takeover
OAuth account takeover via redirect_uri and response_type juggling
Loose redirect_uri matching or switching to the token response type can leak the code or access token to an attacker-controlled URL.
Password reset poisoning via unkeyed Host header
If the reset email builds its link from the Host header and the CDN does not key on it, you can poison the link or steal tokens.