Forced OAuth authorization using button ID in hash and holding space

Summary

An issue with in LinkedIn's OAuth process allows attackers to conduct a social engineering attack to trick a user into authorizing a 3rd party app to bind to their account without explicit consent. Abusing this issue is limited because:

• This requires social engineering in the form of getting a user to visit a phishing link and press and holding a key on their keyboard.
• Access granted to 3rd party apps in this manner are also typically very limited.