eXes & Oauths They Haunt Me: In-Depth Analysis of OAuth OIDC Misconfigurations & Token Replay Attacks

The talk opens by separating OAuth 2.0 from OIDC. OAuth is a delegation framework that issues bearer tokens for resource access without verifying who the user is, while OIDC adds an identity layer through an ID token, typically a JWT. The speaker argues that most real-world compromises come from implementation mistakes rather than flaws in the protocols, and touches on the backend-for-front-end pattern used in modern web apps.

The middle of the talk covers common weaknesses. A missing state parameter leaves the authorization flow open to cross-site request forgery, and loose redirect URI validation lets an attacker send the authorization code or token to a server they control. Discovery document tampering and JWT checks that skip audience, issuer, expiration or nonce validation are also highlighted. A live demo then shows a bearer token returned in a redirect URI being copied to a different machine and used to reach a protected route, because there was no token binding and the token never expired. A Node.js pitfall is also described, where decoding a token is mistaken for verifying it.

For defenders, the talk recommends short-lived tokens, validating audience and issuer on resource servers, enforcing nonces, supporting revocation and introspection, and logging with anomaly detection. The main takeaway is that the frameworks are sound but unforgiving of small configuration gaps, so applications need continuous testing and monitoring. The Q&A touched on passkeys, which share some visibility problems, and on the risks of trusting third-party MCP servers with credentials.