# [Critical] - Steal OAuth Tokens

Microsoft OAuth redirect_uri wildcard on *.twitter.com plus an open redirect on cards.twitter.com leaked OAuth access tokens via URL fragment to an attacker.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: paulos__
- Disclosed: 2016-07-11
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/131202
- Library page: https://bugbountylibrary.com/r/h1%3A131202
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth technique:chained technique:unicode-normalization vuln:auth-bypass vuln:info-disclosure vuln:open-redirect

**Target:** OAuth authorization flow (Microsoft Outlook identity) on twitter.com contact-import endpoint
**Root cause:** The OAuth app registered redirect_uri as twitter.com, so Microsoft accepted any http(s)://*.twitter.com/* host/path. Combined with an open redirect on cards.twitter.com, the token-bearing fragment could be redirected off-domain.
**Steps:**
1. Visit `https://twitter.com/who_to_follow/import` (or trigger contact import) to start Microsoft OAuth.
2. Note Microsoft accepts any `http(s?)://*.twitter.com/*` as redirect_uri.
3. Use open redirect `https://cards.twitter.com/cards/18ce53y6aap/yyms` which redirects to `http://test.com`.
4. Append `%2523` to the redirect URL: `https://cards.twitter.com/cards/18ce53y6aap/yyms%2523` so Microsoft decodes `%2523`->`%23`->`#`, placing the access_token in the fragment.
5. Read the token via `location.hash` on the attacker-controlled destination.
**How found:** Recalled the same misconfiguration as prior report #128119 (Facebook), hypothesized the redirect_uri wildcard `http(s?)://*.twitter.com/*`, then searched for an open redirect on a twitter.com subdomain to satisfy the wildcard and exfiltrate the fragment.
**Exploitation:** Victim clicks a crafted OAuth link; after Microsoft authorization the token is delivered in the URL fragment to the open-redirect endpoint, which forwards to attacker domain where location.hash captures the access_token. Requires only a single click for already-authorized users.
**Insight:** When an OAuth app whitelists a wildcard subdomain pattern, hunt for any open redirect on a matching subdomain; use double-encoding (%2523) so the IdP decodes to '#' and the token lands in the fragment where location.hash can read it.