Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking
🔒
https://infosecwriteups.com
«TL;DRThis one started from setting up the YouTube app on my PS5. The device authorization grant (RFC 8628) it uses, the flow TVs, consoles, and CLIs rely on when they don’t have a browser of their own, turned out to hide...»
Automatische Weiterleitung...
1.5s