writeups.xyz / Traveling with OAuth - Account Takeover on Booking.com

Submitter : c2a

Date: 2 March 2023

Bounty : undisclosed

Vulnerabilities :

• OAuth
• Account Takeover
• Authentication Bypass
• Open Redirect

Programs :

• Booking.com
• KAYAK

Authors :

• Aviad Carmel (@AviadCarmel)

Link :
https://salt.security/blog/traveling-with-oauth-account-takeover-on-booking-com