oauth-oidc-misconfiguration
yaklang/hack-skills
OAuth and OIDC misconfiguration testing playbook for redirect URIs, state/nonce validation, PKCE, and token binding flaws.
What is oauth-oidc-misconfiguration?
Focused checklist for reviewing OAuth 2.0 and OpenID Connect implementations. Use when testing apps with social login, callback flows, or identity provider integrations to identify redirect URI validation gaps, state/nonce handling weaknesses, PKCE enforcement issues, and account binding vulnerabilities.
- Check state parameter handling for missing, static, predictable, or session-unbound values
- Validate redirect_uri processing for prefix matching, open redirect chaining, and path confusion
- Verify PKCE enforcement for public clients and code verifier validation
- Test OIDC nonce validation on ID token returns
- Audit token audience and issuer claims for weak validation and cross-client reuse
- Identify account binding flaws where attacker identity rebinds to victim session
How to install oauth-oidc-misconfiguration
npx skills add https://github.com/yaklang/hack-skills --skill oauth-oidc-misconfigurationHow to use oauth-oidc-misconfiguration
- 1.Map the complete OAuth/OIDC flow including authorize, callback, token exchange, and logout endpoints
- 2.Replay callback requests with altered state, nonce, and redirect_uri values to test validation
- 3.Compare validation strength across different client types (SPA, mobile, web)
- 4.Test account binding by attempting to rebind one provider account to another local account
- 5.Verify PKCE implementation for public clients and code verifier enforcement
- 6.Audit token audience (aud) and issuer (iss) claims for weak validation
Use cases
- Testing social login implementations (Google, GitHub, Microsoft, Okta) for misconfiguration
- Auditing mobile and SPA OAuth flows for weaker validation compared to web clients
- Replaying callback flows with altered state, nonce, and redirect_uri parameters
- Checking whether one provider account can be rebound to another local account
- Mapping full OAuth/OIDC flows to identify token audience and issuer validation gaps
- Security researchers auditing OAuth/OIDC implementations
- Penetration testers reviewing social login and identity provider integrations
- Application security engineers validating redirect URI and token binding logic
- Developers implementing OAuth 2.0 or OpenID Connect flows
oauth-oidc-misconfiguration FAQ
Load when the target uses OAuth 2.0 or OpenID Connect with social login, or when you see authorize, callback, redirect_uri, code, state, nonce, or code_challenge parameters.
Weak or missing state parameter validation, which allows attackers to bypass CSRF protections and hijack authorization flows.
Try prefix matching attacks, open redirect chaining, path confusion, and check for localhost or development URIs left in production.
Verify that public clients (mobile, SPA) enforce PKCE, validate the code verifier, and don't allow downgraded flows without PKCE.
Load jwt-oauth-token-attacks for token cryptography issues, saml-sso-assertion-attacks for enterprise SSO, and cors-cross-origin-misconfiguration for token exposure.
Full instructions (SKILL.md)
Source of truth, from yaklang/hack-skills.
name: oauth-oidc-misconfiguration description: >- OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding, and identity-provider trust flaws.
SKILL: OAuth and OIDC Misconfiguration — Redirects, PKCE, Scopes, and Token Binding
AI LOAD INSTRUCTION: Use this skill when the target uses OAuth 2.0 or OpenID Connect and you need a focused misconfiguration checklist: redirect URI validation, state and nonce handling, PKCE enforcement, token audience, and account binding mistakes.
1. WHEN TO LOAD THIS SKILL
Load when:
- The app supports
Login with Google, GitHub, Microsoft, Okta, or other IdPs - You see
authorize,callback,redirect_uri,code,state,nonce, orcode_challenge - Mobile or SPA clients rely on OAuth or OIDC flows
For token cryptography and JWT header abuse, also load:
- jwt oauth token attacks
2. HIGH-VALUE MISCONFIGURATION CHECKS
| Theme | What to Check |
|---|---|
state handling | missing, static, predictable, or not bound to user session |
redirect_uri validation | prefix match, open redirect chaining, path confusion, localhost leftovers |
| PKCE | missing for public clients, code verifier not enforced, downgraded flow |
OIDC nonce | missing or not validated on ID token return |
| token audience and issuer | weak aud / iss checks, cross-client token reuse |
| account binding | callback binds attacker identity to victim session |
| scope handling | broader scopes granted than the user or client should receive |
3. QUICK TRIAGE
- Map the full flow: authorize, callback, token exchange, logout.
- Replay callback flows with altered
state,nonce, andredirect_uri. - Compare SPA, mobile, and web clients for weaker validation.
- Check whether one provider account can be rebound to another local account.
4. RELATED ROUTES
- CORS or cross-origin token exposure: cors cross origin misconfiguration
- XML federation or enterprise SSO: saml sso assertion attacks
- CSRF-heavy login or binding bugs: csrf cross site request forgery
Related skills
More from yaklang/hack-skills and the wider catalog.
open-redirect
Exploit open redirects via parameter injection, filter bypass, and chaining with phishing, OAuth token theft, and SSRF.
path-traversal-lfi
Expert path traversal and LFI attack playbook with encoding bypass, log poisoning, and PHP wrapper exploitation.
prototype-pollution
Test JavaScript prototype pollution in client and server contexts via __proto__ and constructor.prototype paths.
prototype-pollution-advanced
Escalate confirmed prototype pollution to RCE via template engines, child_process gadgets, and client-side script exploitation.
race-condition
Test race conditions and TOCTOU vulnerabilities in web apps via synchronized parallel requests.
recon-and-methodology
Systematic reconnaissance and bug-hunting methodology for mapping assets, discovering endpoints, and building structured testing plans.