writeups.xyz / XSS to OAuth access token leak in office online which can be used to account takeover

Submitter : c2a

Date: 12 January 2024

Bounty : 500

Vulnerabilities :

• XSS
• CSP Bypass
• PostMessage

Programs :

• Microsoft

Authors :

• Renwa (@RenwaX23)

Link :
https://gist.github.com/RenwaX23/0311842bb790ce98fe0cd8f41141fdf0