Exploiting OAuth 2.0 and OpenID Connect: Lessons Learned from Bug Bounty Programs

No ratings

Presented at BSidesAtlanta 2020 by

Nawwar Kabbani

zoom.us

Modern authorization and authentication designs commonly rely on OAuth 2.0 and OpenID Connect (OIDC), and other related standards. When implemented properly, these protocols are powerful, flexible, and secure. However, design and implementation mistakes are common. Those mistakes could lead to a range of risks that vary from mild to severe, such as complete authentication bypass and and privilege escalation issues. To get an realistic insight about those risks, public bug bounty programs also provide us with a great information of different security vulnerabilities, including those associated with authorization and authentication problems. This technical presentation will review several examples of design and implementation flaws related to the modern authorization and authentication standards, their security risks, and how to mitigate those risks. This presentation is helpful for security architects, developers, testers, and anybody involved in implementing OAuth 2.0 or OIDC systems.