From 6e368a84c23950362494b8919510f6dcf4edc509 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Fri, 20 Mar 2026 18:51:28 +0000 Subject: [PATCH] Add content from: CVE-2026-31381, CVE-2026-31382: Gainsight Assist Information... --- .../oauth-to-account-takeover.md | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/src/pentesting-web/oauth-to-account-takeover.md b/src/pentesting-web/oauth-to-account-takeover.md index 58ad85b3af2..d1b1cf2e192 100644 --- a/src/pentesting-web/oauth-to-account-takeover.md +++ b/src/pentesting-web/oauth-to-account-takeover.md @@ -108,6 +108,29 @@ As mentioned in this bug bounty report [https://blog.dixitaditya.com/2021/11/19/ https://app.victim.com/login?redirectUrl=https://app.victim.com/dashboard

test

``` +### OAuth callback error pages: reflected `error_description`, trusted-origin phishing, and encoded `state` leakage + +Some OAuth integrations use a **first-party callback page** to render login failures after the IdP redirects the browser back. These pages are high value because they already run on a **trusted origin** and often consume attacker-controlled parameters such as `error`, `error_description`, `message`, `description`, or `state`. + +- **Reflecting `error_description` into HTML** without strict output encoding turns the callback into a **trusted-origin phishing page**. Even when `