launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API
HackerOneBasecamp2026-10-30
Web, API
High
BUG BOUNTY WRITEUPS
OAuth and SSO writeups
OAuth, OpenID Connect and SAML flaws: redirect_uri tricks, state handling, token leakage and account linking bugs that end in takeover.
46 reports and writeups from 2024 to 2026. 15 carry a severity from the disclosing platform, 7 of them rated High or Critical. Last updated 2026-10-30.
Latest OAuth and SSO reports
Search and filter all writeupswordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list
HackerOneWordPress2026-10-30
Web
Medium
A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option
HackerOneBasecamp2026-10-30
Web
High
Web
Not rated
Web
Not rated
Web
Not rated
Code injection allows unprivileged local attacker to execute arbitrary code in Nextcloud's OAuth/web renderer process
HackerOneNextcloud2026-10-24
Web, Cloud
Low
OAuth Redirect URI Manipulation via X-Forwarded-Host Injection
Medium2026-10-20
Web, Cloud
Not rated
Authentication Bypass via XML Signature Wrapping in SAML SSO
HackerOneRocket.Chat2026-07-27
Web
Critical
OAuth redirect uri validation bypass for :proxima_first_party_sync apps
HackerOneGitHub2026-07-21
Web
High
page.line.me Open Redirect Leading to OAuth Authorization Code Exposure and Access Token Compromise
HackerOneLY Corporation2026-06-02$1,000 bounty
Web
High
Story of Abusing a Fully Secured redirect_uri in an OAuth Flow
Researcher blog2026-03-21
Web
Not rated
Connection Reuse Ignores OAuth Bearer Token Mismatch
HackerOnecurl2026-03-10
Web
Medium
When Two Parsers Disagree: Exploiting Query String Differentials for XSS
Researcher blog2026-02-10
Web
Not rated
The Fragile Lock: Novel Bypasses For SAML Authentication
PortSwigger Research2025-12-10
Web
Not rated
DOM XSS to Account Takeover: not-so-dirty dancing in a GIS SDK
Researcher blog2025-12-07
Web
Not rated
Double Clickjacking Attack on WakaTime OAuth Authorization Flow at https://wakatime.com/oauth/authorize
HackerOneWakaTime2025-08-05
Web
Medium
Puny-Code, 0-Click Account Takeover
Researcher blog2025-06-01
Web
Not rated
Open Redirect Vulnerability in OAuth Flow Leading to Potential Phishing Attack
HackerOneLichess2025-05-15
Web
Low
Forced OAuth authorization using button ID in hash and holding space
HackerOneLinkedIn2024-12-17
Web
Medium
SAML Signature verification bypass allows logging into any user (with specific conditions)
HackerOneGitHub2024-10-10
Web
Critical
Account Takeover due to DNS Rebinding
Researcher blog2024-09-17
Web
Not rated
Login email verification bypass via `/oauth/token`.
HackerOneGitLab2024-09-03
Web
Not rated
How I Got $250 For My Second Bug on HackerOne
Medium2024-09-01$250 bounty
Web
Not rated
Forced SSO Session Fixation
InfoSec Write-ups2024-08-16
Web
Not rated
AI Under Siege: Discovering and Exploiting Vulnerabilities
Researcher blog2024-08-05
Web, AI
Not rated
SAML Authentication Bypass Leading to Admin Panel Access
Medium2024-08-01
Web
Not rated
Plug Security Holes in React Apps That Can Lead to API Exploitation
Researcher blogSiemens2024-07-31
Web, API
Not rated
Stealing First Party Access Token of Facebook Users: Meta Bug Bounty
MediumMeta / Facebook2024-07-30
Web
Not rated
Over 1 Million websites are at risk of sensitive information leakage - XSS is dead. Long live XSS
Researcher blogHotjar2024-07-29
Web
Not rated
Self XSS + Login CSRF + OAuth = Account Takeover
Medium2024-07-02
Web
Not rated
Teleport Security Whitepaper - Practical Analysis of and Hardening Against Compromised IdP Scenarios
Researcher blogTeleport2024-06-20
Web
Not rated
Mobile OAuth Attacks - iOS URL Scheme Hijacking Revamped
GitHub2024-06-17
iOS
Not rated
Zoom Session Takeover - Cookie Tossing Payloads, OAuth Dirty Dancing, Browser Permissions Hijacking, and WAF abuse
GitHubZoom2024-06-07$15,000 bounty
Web
Not rated
ID4me feature of OpenID connect app available even when disabled
HackerOneNextcloud2024-05-30
Web, Cloud
Medium
POST to XSS: Leveraging Pseudo Protocols to Gain JavaScript Evaluation in SSO Flows
Researcher blogOneLogin, Authentik, FusionAuth2024-05-10
Web
Not rated
CVE-2024-25128: Apache Airflow: Authentication Bypass when Legacy OpenID(2.0) is in use as AUTH_TYPE
HackerOneInternet Bug Bounty2024-04-28
Web
Medium
How we escalated a DOM XSS to a sophisticated 1-click Account Takeover for $8000 - Part 1
GitHub2024-04-06$8,000 bounty
Web
Not rated
Oauth Misconfiguration Leads to 0-Click ATO
Medium2024-04-02
Web
Not rated
Security Flaws within ChatGPT Ecosystem Allowed Access to Accounts On Third-Party Websites and Sensitive Data
Researcher blogOpenAI (ChatGPT), PluginLab.AI, KesemAI2024-03-13
Web, AI
Not rated
Angular-ing for AuthZ, Problematic anti-patterns in Single Sign On Systems
Researcher blog2024-03-05
Web
Not rated
Continuing the Citrix Saga: CVE-2023-5914 & CVE-2023-6184
Researcher blogCitrix Systems2024-02-20
Web, Source Code
Not rated
Hacking Microsoft and Wix with Keyboard Shortcuts
Researcher blogMicrosoft, Wix2024-02-15
Web
Not rated
HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organization
HackerOneHackerOne2024-02-04
Web
High
Auth Bypass Round Two
Researcher blogIvanti2024-02-02
Web, Source Code
Not rated
XSS to OAuth access token leak in office online which can be used to account takeover
GitHubMicrosoft2024-01-12$500 bounty
Web
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.