Entry 002
An IDOR that became account takeover through OAuth
The object reference was only half of it. This follows the OAuth binding that trusted a client-supplied identifier, and the full takeover it allowed.
The reference
Incrementing an identifier returned another user’s profile. On its own that is a disclosure bug and a moderate one.
The escalation
The same identifier was accepted as the subject when linking a social account. Nothing re-derived it from the session, so the link could be pointed at any account and then used to authenticate as its owner.
The fix
Bind the identity to the session that requested the link, not to a value the client supplies.