X / xAI · Report #283460
Open Redirect Protection Bypass
Validstatus
24upvotes
23 Dec 2017disclosed
How it was found
Hi
Report #281538 is fixed but Attacker can Bypass this Open Redirect Protection.
Give this link https://twitter.com/teams/authorize?target_screen_name=&authorize_callback=//www.facebook.com to authorized victim.Twitter will say him to authorize a different account for create team.After authorization victim will be redirected to www.facebook.com
Vulnerable point //www.facebook.com (You can use //www.example.com )
Open Redirection Protection Bypassed.
PoC video attached
With Best Regards