[wp-trac] [WordPress Trac] #51296: OAuth Token Re-use

[WordPress Trac]

#51296: OAuth Token Re-use
--------------------------+-----------------------------
 Reporter:  tuhin1729     |      Owner:  (none)
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  General       |    Version:
 Severity:  major         |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 Hello seurity team,
  I have found OAuth token re-use bug at wordpress.com

 Steps to reproduce:
  1. Go to wordpress.com
  2. Login with OAuth Functionality
  3. Copy the entire post data that contain OAuth token
  4. Now forward the request
  5. Now logout and login with another account using OAuth functionality
 but this time from different email address
  6. Capture the oauth request and replace it with the previous one
  7. You'll see that you are logged in as the previous account

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/51296>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform