OAuth Misconfiguration
High · Authentication
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-863
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-863
Definition
Insecure redirect URIs, missing PKCE/state, token leakage.
Root cause
Loose redirect validation; public clients without PKCE.
Affected components
- Components in the “Authentication” class
- Application / API handlers
- Supporting libraries
Impact
Account takeover, token theft.
Severity
High · CVSS 8.1
Safe lab reproduction
lab-oauth
Detection methodology
OAuth flow review; redirect fuzzing in labs.
Evidence examples
- Lab reproduction notes: lab-oauth
- Request/response excerpts (redacted)
- Detection signal: OAuth flow review; redirect fuzzing in labs
Remediation
Exact redirect allow-list; PKCE; short-lived tokens.
Secure coding examples
Use proven OAuth/OIDC libraries.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.