What problem does it solve? OAuth 2.0 and OpenID Connect integrations frequently contain subtle misconfigurations in redirect URI validation, state and nonce handling, PKCE enforcement, and token audience checks that lead to account takeover or token theft, and this Skill provides a focused checklist for finding them. ## Core Features & Use Cases - Misconfiguration Checklist: Covers state handling, redirect_uri validation, PKCE enforcement, OIDC nonce validation, token audience and issuer checks, account binding, and scope handling. - Quick Triage Workflow: Guides mapping the full authorize/callback/token flow, replaying callbacks with altered parameters, and comparing SPA, mobile, and web clients for weaker validation. - Related Skill Routing: Links to JWT token attacks, CORS misconfiguration, SAML SSO assertion attacks, and CSRF skills for adjacent vulnerability classes. - Use Case: When testing an application that offers "Login with Google" or another identity provider, load this Skill to systematically replay callback flows with altered state, nonce, and redirect_uri values to find account binding or token reuse flaws. ## Quick Start Load this skill when the target uses OAuth or OIDC login and test the callback flow by replaying requests with modified state, nonce, and redirect_uri parameters.
