Oauth Oidc Misconfiguration

A focused checklist for finding OAuth and OIDC integration bugs, the kind that let attackers hijack login flows or bind their identity to someone else's account. It walks through redirect URI validation holes, missing or broken state and nonce checks, PKCE enforcement gaps, and token audience mismatches. The triage is practical: map the full flow, replay callbacks with tampered parameters, compare how web versus mobile clients validate the same flow. If you're auditing anything with "Login with Google" buttons or seeing authorize endpoints in traffic, this gives you a methodical way to catch the configuration mistakes that still ship in production despite OAuth being around for over a decade.

skills.sh installs: 3.9K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill oauth-oidc-misconfiguration --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: OAuth and OIDC Misconfiguration — Redirects, PKCE, Scopes, and Token Binding

AI LOAD INSTRUCTION: Use this skill when the target uses OAuth 2.0 or OpenID Connect and you need a focused misconfiguration checklist: redirect URI validation, state and nonce handling, PKCE enforcement, token audience, and account binding mistakes.

1. WHEN TO LOAD THIS SKILL

Load when:

The app supports Login with Google, GitHub, Microsoft, Okta, or other IdPs
You see authorize, callback, redirect_uri, code, state, nonce, or code_challenge
Mobile or SPA clients rely on OAuth or OIDC flows

For token cryptography and JWT header abuse, also load: