writeups.xyz / OAuth authentication bypass on Airbnb acquisition using 1-char Open Redirect

Submitter : c2a

Date: 10 July 2019

Bounty : undisclosed

Vulnerabilities :

• Open Redirect
• Token Leak
• Account Takeover

Programs :

• Airbnb

Authors :

• Evgeniy Yakovchuk (@H1_sp1d3r)

Link :
https://xp.ht/oauth-authentication-bypass-on-airbnb-acquisition-using-weird-1-char-open-redirect/