# CSRF in Connecting Pinterest Account

Pinterest OAuth connect flow lacked state parameter, letting an attacker swap a victim's linked Pinterest account for their own via a crafted callback URL.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: mercurii
- Disclosed: 2016-02-02
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/104931
- Library page: https://bugbountylibrary.com/r/h1%3A104931
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:oauth vuln:auth-bypass vuln:csrf

**Target:** OAuth callback endpoint pinterest-commerce.shopifyapps.com/auth/pinterest/callback
**Root cause:** The Pinterest OAuth connect flow did not use or validate a state parameter, so the callback URL was not bound to the initiating user's session.
**Steps:**
1. Victim already has a Pinterest account connected to their shop.
2. Attacker starts connecting their own Pinterest account and authorizes the Shopify app.
3. Attacker intercepts the redirect to `https://pinterest-commerce.shopifyapps.com/auth/pinterest/callback?code=d0c18854a3359866774d479614081453d235962f` and drops it.
4. Attacker induces the victim to load the captured callback URL.
5. Victim's connected Pinterest account is replaced with the attacker's.
**How found:** Researcher observed the Pinterest connect callback accepted a code without a state parameter, indicating the flow was not tied to the initiating session.
**Exploitation:** Attacker captures their own valid OAuth callback code and lures the victim into visiting it; the callback binds the attacker's Pinterest account to the victim's shop, replacing any existing connection.
**Insight:** OAuth connect/link flows that overwrite an existing linked account are prime CSRF targets: capture your own callback code, drop the request, and replay the URL against a victim to hijack the link.