# One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.com

Null byte appended to OAuth state parameter bypassed CSRF protection in Streamlabs Twitch merge flow, letting attacker link their Twitch to victim's account and take it over.

- Payout: hidden
- Severity: medium
- Program: Logitech
- Found by: vbsec
- Disclosed: 2021-01-06
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1046630
- Library page: https://bugbountylibrary.com/r/h1%3A1046630
- Tags: area:web3 domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:oauth technique:chained technique:incomplete-fix vuln:account-takeover vuln:auth-bypass vuln:csrf

**Target:** OAuth callback /auth on streamlabs.com (Twitch account merge)
**Root cause:** State parameter validation truncated or mishandled at a null byte, so a state value with a trailing %00 passed CSRF checks while still being accepted by the OAuth callback.
**Steps:**
1. Login as attacker, go to Settings > Account Settings, intercept 'merge Twitch account' request in Burp.
2. Allow Twitch access; capture GET to streamlabs.com/auth with code, scope, state; drop it to avoid consuming the one-time code.
3. Generate CSRF PoC from Burp and append `%00` to the state parameter.
4. Host PoC on attacker.com and lure victim to visit and click.
5. Victim's account gets attacker's Twitch linked; attacker logs in via Twitch to hijack victim account.
**How found:** Researcher revisited a prior report (#1039749) on the same merge flow and hypothesized that appending a null byte to the state parameter would bypass the CSRF check while still being accepted by the OAuth handler.
**Exploitation:** Attacker pre-obtains a valid OAuth code for their own Twitch account, embeds it in a CSRF page with state ending in %00, and tricks the victim into loading it; the callback links attacker's Twitch identity to the victim's Streamlabs account, enabling login as the victim.
**Escalation:** Chains OAuth CSRF with account-linking to achieve full account takeover and access to linked PayPal/YouTube/etc.
**Insight:** When a state/CSRF token check was previously patched, try appending %00 or other truncation characters to the state value: backend string comparison may stop at the null byte while the OAuth provider still accepts the token, re-enabling the CSRF.