One Callback URL Misconfiguration Leaks Every OAuth Token

✓ Human-authored analysis; AI used for formatting and proofreading. Your Cognito app client has http://localhost:3000/callback in its allowed callback URLs. It was added during development. Nobody removed it. That URL is now a token exfiltration endpoint. An attacker crafts an authorization link that redirects the OAuth response containing the...