Who Moved My Account? OAuth Account Takeover Vulnerabilities in "Many Famous Companies"

No ratings

Presented at Zer0Con 2025 by

Ji'an Zhou

Open Authorization (OAuth) is an open-standard authorization framework that grants applications access to an end user's protected resources—such as photos, calendars, or social media posts—without requiring the login credentials of the user's account. OAuth brings convenience to people but also poses significant security risks. In fact, if OAuth's design and implementation are improper, it can lead to serious account takeover issues. After attackers take over user accounts, they can not only obtain users' private information but also cause significant losses to users' property and other assets. However, through testing, I found that many enterprises still have serious OAuth implementation problems. Some of these enterprises are even very well-known companies, which seems a bit incredible. Here, I will present for the first time my test results for leading companies in different industries. I will vividly introduce the flaws in their designs and explain how I combined seemingly insignificant vulnerabilities into a perfect account takeover vulnerability.