← LibraryTechnique entry
W-OAUTH-MISCONFIGCredential Access
OAuth — redirect_uri Misconfig
Server accepts a wildcard / partial-match / open redirect-uri — steal the authorization code from the callback.
§ Where this technique fits
W-OAUTH-MISCONFIG is catalogued under the Credential Access tactic of the offensive-security kill-chain. It appears in 2 approved dossiers in the registry, typically at step 3.5 on average.
§ Dossiers chaining this technique
- step 2 / 8
OAuth redirect_uri misconfig → account takeover
Provider accepts loose redirect_uri matching (wildcard, partial, open-redirect chain). Steal the authorization code by redirecting it through an attacker host.
- step 5 / 6
iOS URL scheme hijack → OAuth code theft
Multiple apps register the same custom URL scheme — a rogue app installed alongside the target receives the OAuth callback containing the authorisation code, then exchanges it for tokens.
§ What commonly comes next
- 01Use Alternate Authentication Materialseen 2×T1550 · Lateral Movement
- 02Open Redirectseen 1×W-OPEN-REDIRECT · Initial Access
- 03Phishingseen 1×T1566 · Initial Access