To anyone who thought partial redirect URL matching in @OAuth_2 ... • Aaron Parecki

47°F

To anyone who thought partial redirect URL matching in @OAuth_2 is "good enough," read this thread. Complete Periscope account takeover just by viewing a tweet. https://hackerone.com/reports/110293 #oauth

Toronto, Ontario, CAN

Mon, May 27, 2019 4:54pm -04:00 #oauth

13 likes 6 reposts 2 replies
Have you written a response to this? Let me know the URL:
- Aaron Parecki twitter.com/aaronpk
  
  but not that tweet 😉
  
  Tue, May 28, 2019 12:36pm +00:00 (via brid-gy.appspot.com)
- Imaginary G twitter.com/TheHammerSpeaks
  
  Risky click?
  
  Tue, May 28, 2019 5:30am +00:00 (via brid-gy.appspot.com)

Posted in /notes using quill.p3k.io