Token Leak | writeups.xyz

Title	Vulnerabilities	Programs	Authors
HTML Over the Wire	CSRF Token Leak	Hotwire Turbo Htmx	Ryan (@Healthyoutlet)
googlesource.com access_token leak (Awarded $7500)	URL Validation Bypass Regex Token Leak	Google	NDevTK (@Ndevtk)
Stealing GitHub staff's access token via GitHub Actions	CI/CD Token Leak Privilege Escalation Supply Chain Attack	GitHub	RyotaK (@Ryotkak)
OAuth 2.0 Authentication Misconfiguration	OAuth Account Takeover Open Redirect Token Leak	Undisclosed	Mohamed Lakhdar Metidji (@Minometidjii)
draw.io CVEs	SSRF OAuth Open Redirect Token Leak Security Code Review	Draw.io	@Caioluders
Simple CORS misconfig leads to disclose the sensitive token worth of $$$	CORS Misconfiguration Token Leak	Linear	Ramalingasamy
Fun With CORS	CORS Misconfiguration Token Leak	Undisclosed	Talis Ozols
Never underestimate the power of open redirect, a story of a full account takeover	Open Redirect Account Takeover Token Leak	Undisclosed	Ibrahim Auwal (@Ibrahimatix0x01)
Sensitive Data Exfiltration through XSS ($450)	Token Leak	Undisclosed	Zulfi Al-Farizi
Full Account Takeover via Open Redirection	Open Redirect Token Leak Account Takeover OAuth	Undisclosed	VFlexo (@Vflexo)
OAuth and PostMessage - Chaining misconfigurations for your access token.	OAuth PostMessage Token Leak	Undisclosed	Suraj Disoja (@Ninetyn1ne_)
Bug Hunting Journey of 2021	Stored XSS Open Redirect Token Leak CSRF Logic Flaw Information Disclosure IDOR Account Takeover	Undisclosed	Sudhanshu Rajbhar (@Sudhanshur705)
Bypassing Identity-Aware Proxy - Google Cloud Vulnerability	Broken Authorization Token Leak OAuth	Google	SebLu
Account Takeover via improper input validation	OAuth Token Leak Account Takeover	Undisclosed	Gaurav Narwani (@Gauravnarwani97) Verneet (@Err0rrrrr)
Stealing tokens, emails, files and more in Microsoft Teams through malicious tabs	PostMessage Token Leak	Microsoft	Evan Grant (@Stargravy)
Exploiting API with AuthToken	Token Leak Information Disclosure	Undisclosed	Rafi Ahamed (Leonidas D. Ace)
How i got 200$ with an out of the box open redirect vulnerability	Open Redirect Token Leak	Undisclosed	Tarek Galleze
DOM based open redirect to the leak of a JWT token	Open Redirect DOM-Based Open Redirect Token Leak	Undisclosed	Adolphoramirez
OAuth authentication bypass on Airbnb acquisition using 1-char Open Redirect	Open Redirect Token Leak Account Takeover	Airbnb	Evgeniy Yakovchuk (@H1_sp1d3r)
Leaking OpenID tokens with “ — the bug right infront of you	OIDC Open Redirect Token Leak	Undisclosed	Zseano (@Zseano)
Hijacking accounts by retrieving JWT tokens via unvalidated redirects	Open Redirect Token Leak	Undisclosed	Shawar Khan (@ShawarkOFFICIAL)
Stealing Side-Channel Attack Tokens in Facebook Account Switcher	Token Leak	Meta / Facebook	Max Pasqua
Full Account Takeover via Referer Header (OAuth token Steal, Open Redirect Vulnerability Chaining)	Open Redirect Token Leak Account Takeover	Undisclosed	Muhammad Asim Shahzad (@Protector47)

Page 1 of 1