LogicalBreach Academy

Unauthenticated OAuth Token Leading to Access to Protected APIs | Free Bug Bounty Writeup | LogicalBreach Academy

BackUnauthenticated OAuth Token Leading to Access to Protected APIs

Improper Access Control - Generic (CWE-284)CVSS 9.8€1,500

Unauthenticated OAuth Token Leading to Access to Protected APIs

hidalg0d

March 6, 2026

6 min 167

Save

What started as a simple JavaScript analysis ended in a broken OAuth flow that allowed unauthenticated access to protected APIs — and a €1500 bug bounty reward.

Summary

While performing reconnaissance on a web application, I discovered that it was possible to obtain a valid OAuth access token without any authentication.

The issue started with a publicly accessible JavaScript file exposing an OAuth client_id.
Using this identifier, the authorization server issued a valid access token without requiring any user authentication.

The token could then be used to interact with protected backend APIs that executed real business logic.

Identification Required

You must be logged in to read this writeup. Join our community of researchers today.

Discussion2

hackermater144d ago

Great write-up! It's quite interesting how by digging into JS files it's possible to obtain sensitive information such as the client_id and to escalate privileges accessing to protected API endpoints. It requires critical thinking and good eye to detail. Thanks for sharing!

hidalg0dHUNTER142d ago