https://422fce27.blog-8x6.pages.dev/tags/web/Recent content in Web on LiniomHugoenFri, 11 Sep 2026 11:19:40 +0200https://422fce27.blog-8x6.pages.dev/posts/identity-crisis/Fri, 11 Sep 2026 11:19:40 +0200https://422fce27.blog-8x6.pages.dev/posts/identity-crisis/<div class="paragraph"> <p>Most SSO bugs are easy to spot once you look. The app skips signature validation, accepts the wrong issuer, forgets <code>state</code>, or leaves an open redirect in the callback.<br/> <br/> nOAuth is harder to see. Every check on the token can pass and <code>email_verified</code> can be true, yet the app still logs the attacker into someone else’s account, because it uses the email address to decide which account to open.</p> </div>