Inflection · Report #243001
Open Redirect
Validstatus
mediumseverity
18upvotes
20 Oct 2017disclosed
Summary
Researcher discovered an issue in the Identity.com OAuth flow, where crafting an /authorize URL with certain parameters missing would enable an attacker to redirect the end user to an arbitrary URL if the redirect_uri variable was included.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.