Unless you've been living under a rock for the past 10-years, you should be familiar with OAuth. OAuth is an open standard for authorization and authentication that can be applied to many use cases. One very popular scenario is the famous "Social Login" functionality offered by every major website today.Given several OAuth research projects have already been conducted, highlighting major OAuth security issues which have been exploited and addressed, it's easy to assume that OAuth must be really secure by now - however one cannot help but wonder, how well-secured OAuth really is in 2023? Surely, it must be secured - right?Our research says otherwise. We dove into the world of OAuth and its various "secured" implementations. By applying advanced attack techniques, we managed to gain control of accounts on popular applications and websites – household brand names – each with more than 100 million users, in some cases including a framework that serves dozens of other sites. Despite the targets' awareness of OAuth and security measures, we were able to bypass every mitigation and exploit a different kind of vulnerability in every target, showing that often the problem is not in OAuth itself but in its implementation.In our presentation, we will break down the difficulties of integrating OAuth, share the common missteps we have identified, and present advanced techniques not revealed in any lecture before – all based on real-world use cases.At the end of the day, our research gave us (potential) access to *one billion accounts* – fortunately, they're all a bit more secure now. How secure is your OAuth?