TL;DRThis one started from setting up the YouTube app on my PS5. The device authorization grant (RFC 8628) it uses, the flow TVs, consoles, and CLIs rely on when they don’t have a browser of their own, turned out to hide two stacked bugs in Google’s implementation.Two bugs stack together. First, the session that anchors a device-code sign-in is...