/hunt-oauth

name: hunt-oauth
description: Hunting skill for OAuth 2.0 / 2.1, OpenID Connect (OIDC), SAML SSO, and JWT authentication. Built from 365 public OAuth/SSO bug bounty reports across HackerOne, GitHub Security Advisories, PortSwigger Research, GitHub Security Lab, Detectify, Doyensec, Salt Labs, Semperis, Obsidian Security, Trace37 plus 2024-2026 meta verified against NVD — ruby-saml parser differentials (CVE-2025-25291/25292, GHSL-2024-329/330), Authentik regex redirect_uri (CVE-2024-52289), workers-oauth-provider PKCE downgrade and redirect_uri (CVE-2025-4143/4144), Entra ID actor token cross-tenant impersonation (CVE-2025-55241), Hono JWT alg confusion (CVE-2026-22817), nOAuth omniauth-microsoft_graph (CVE-2024-21632), Tekton git resolver token exfil (CVE-2026-40161), Flux Operator OIDC empty claims (CVE-2026-23990), Argo CD project token (CVE-2025-55190), tinyauth OIDC client binding (CVE-2026-32245). Use when hunting OAuth / OIDC / SAML / JWT / SSO bugs on web apps, mobile apps, single-page apps, MCP servers, agentic LLM tool-use plugins, GitOps controllers, K8s admission, identity providers, federated login, or any place a `redirect_uri`, `state`, `code`, `access_token`, `id_token`, `assertion`, `client_id`, `client_secret`, `code_verifier`, `code_challenge`, `nonce`, `aud`, `iss`, `sub`, `kid`, or `jku` parameter is processed.
sources: hackerone_public, hackerone, github_advisories, github_deep, securitylab_github, portswigger_research, devcore_blog, descope_blog, semperis_blog, obsidiansecurity_blog, salt_labs, detectify_labs, doyensec_blog, trace37_labs, nvd_verified
report_count: 365
generated_at: 2026-05-04
quality_score: 120/120

Crown Jewel Targets

OAuth/OIDC/SAML/JWT is the universal entry point to *every* enterprise account. A single missing `state` check or loose `redirect_uri` regex turns into a one-click ATO and the program rates it Critical because the impact is multiplicative — once you ride someone's session, you have all their data, all their integrations, all their tokens. The 24-month meta has shifted decisively toward six asset types. All CVEs below verify against NVD.

**1. MCP servers and agentic LLM OAuth (the new gold rush, 2025-2026 meta).** Model Context Protocol servers exploded in adoption with broken OAuth implementations. **CVE-2025-4143** (Cloudflare workers-oauth-provider missing redirect_uri validation, fixed v0.0.5) and **CVE-2025-4144** (PKCE downgrade in same library) define the opening salvo. Obsidian Security's Square MCP one-click ATO (July-September 2025 disclosures, fixed late September 2025) showed anonymous-cookie injection chained with IdP consent caching. **CVE-2025-6514** (mcp-remote OS command exec via crafted `authorization_endpoint` URL, 558,846 downloads affected, JFrog disclosure) and **CVE-2025-49596** (Anthropic MCP Inspector unauth RCE, 38K weekly downloads). FastMCP OAuth Proxy missing `resource` validation (GHSA-5h2m-4q8j-pqpj) means tokens issued for one MCP server work against any MCP server sharing the same authorization server. Hunt MCP servers first — every developer is wiring up OAuth for the first time and getting it wrong.

**2. SAML on enterprise SSO (parser-differential renaissance).** **CVE-2025-25291** + **CVE-2025-25292** (ruby-saml signature wrapping via REXML/Nokogiri parser differential, ahacker1 + Peter Stöckli, GHSL-2024-329 + GHSL-2024-330, GitHub Security Lab) opened a critical hole in any Ruby app using SAML — including unauthenticated admin access to GitLab Enterprise as demonstrated by Gareth Heyes and Zakhar Fedotkin in PortSwigger's "SAML Roulette" research (March 2025). **CVE-2025-46572** (passport-wsfed-saml2 SAML signature wrapping, Auth0/Okta), **CVE-2025-47949** (samlify SAML signature wrapping, npm `samlify < 2.10.0`), **CVE-2024-45409** (ruby-saml ahacker1 baseline). Pair this with Admidio SAML (GHSA-p9w9-87c8-m235 ACS URL injection, GHSA-25cw-98hg-g3cg signature validation result discarded — both 2026, high severity). Old SAML libraries on enterprise SSO are paying again.

**3. JWT algorithm confusion (the regression class).** **CVE-2026-22817** (Hono JWT middleware RS256→HS256 confusion, CVSS 8.2, Cloudflare Workers/Deno/Bun ecosystem, fixed 4.11.4), **CVE-2026-22818** (Hono JWK middleware untrusted header.alg fallback when JWK lacks `alg`, GHSA-3vhc-576x-3qv4), **CVE-2024-54150** (cjwt C library RS/EC/PS algorithm confusion, fixed 2.3.0), **CVE-2024-37568** (Authlib HMAC verification with asymmetric public key, milliesolem disclosure), **CVE-2025-61152** (python-jose alg=none, disputed but real on `verify_signature: False` configurations). Every JWT library that doesn't pin algorithms is exploitable. Greppable in 30 seconds with `jwt.verify(token, secret)` patterns.

**4. nOAuth and Entra ID identity confusion (Microsoft pays directly).** **CVE-2024-21632** (omniauth-microsoft_graph nOAuth, GHSA-5g66-628f-7cvj, fixed 2.0.0) is the canonical disclosed example of Descope's June 2023 nOAuth research — apps trusting the `email` claim from Entra ID get cross-tenant ATO. Semperis found 9% of Entra Gallery apps still vulnerable in June 2025; estimated 15,000+ SaaS apps still exposed. Descope earned $75K+ in coordinated bounties for the original nOAuth class. **CVE-2025-55241** (Dirk-jan Mollema, Entra ID actor token cross-tenant Global Admin impersonation, CVSS 10.0, fixed July 17 2025) extended the class to *Microsoft itself* — any free Entra tenant could impersonate any user in any other tenant via the legacy Azure AD Graph API not validating the `actort` token's originating tenant. Hunt every "Sign in with Microsoft" button by registering a free Entra tenant and changing your email.

**5. Authorization server implementations on managed identity platforms.** **CVE-2024-52289** (Authentik OAuth2 regex redirect_uri bypass via unescaped `.`, Lukas Omegapoint disclosure, fixed 2024.10.3 / 2024.8.5, GHSA-3q5w-6m3x-64gj), **CVE-2024-23647** (Authentik PKCE downgrade by removing `code_challenge`,