User account compromised authentication bypass via oauth token impersonation

Summary

OAuth token impersonation is actually a bug when 3rd party company app or malicious app collects the access token of the same user then that company can access to user account on PicsArt. The condition is that the user needs to authorized both PicsArt and malicious app with same Facebook or Google.

The Solution was to Validate that access_token belongs to PicsArt client_id via provider API.