Question

During a web application assessment, a tester examines an OAuth 2.0 authorization code flow. The authorization server validates the redirect_uri parameter using only a prefix match (it checks that the value begins with https://app.example.com). The tester notices the client application also hosts an open redirect at https://app.example.com/go?url=. Which attack does this combination most directly enable?

Accepted Answer

Stealing the authorization code by chaining the open redirect to forward the code to an attacker-controlled host

Answer

Downgrading the flow to the implicit grant to expose the client secret

Answer

Forging a JWT by exploiting the 'none' algorithm during token issuance

Answer

Performing a CSRF attack against the token revocation endpoint