# One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.com

Apple sign-in response_type switched to code+id_token with fragment mode, leaking OAuth code via redditmedia.com window.name to attacker, enabling full Reddit account takeover.

- Payout: hidden
- Severity: critical
- Program: Reddit
- Found by: fransrosen
- Disclosed: 2022-08-02
- Write-up quality: 9/10
- Original: https://hackerone.com/reports/1567186
- Library page: https://bugbountylibrary.com/r/h1%3A1567186
- Tags: area:web3 domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:critical tech:oauth technique:chained vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** Apple OAuth sign-in flow on www.reddit.com and www.redditmedia.com GTM jail iframe
**Root cause:** Reddit's Apple OAuth app allowed response_type=code+id_token and response_mode=fragment (not just web_message), so tokens land in the URL fragment; redditmedia.com's GTM jail iframe forwards window.name (including fragment) and runs attacker-controlled GTM JS on the same origin, letting it read the victim's URL.
**Steps:**
1. Attacker performs Apple sign-in on Reddit, extracts their own `state` value.
2. Attacker builds victim URL with `?state=<attacker_state>` and sends to victim.
3. Page loads `https://www.redditmedia.com/gtm/jail?id=GTM-N3HH8D6&state=<state>` in an iframe; GTM script renders a link to `https://appleid.apple.com/auth/authorize?client_id=com.reddit.RedditAppleSSO&redirect_uri=https%3A%2F%2Fwww.reddit.com&response_type=code+id_token&state=<state>&scope=&response_mode=fragment`.
4. Victim clicks link, completes Apple sign-in; main window URL becomes `https://reddit.com/#state=xxx&code=xxx&access_token=xx`.
5. GTM script polls `parent.window.b.frames[0].window.name` (same-origin redditmedia iframe) and postMessages the fragment to attacker page.
6. Attacker page parses `code`/`id_token`/`state`, logs them, then replays `opener.postMessage('{"method":"oauthDone",...}','*')` from Apple popup to Reddit to log in as victim.
**How found:** Researcher was exploring postMessage-based OAuth code/token theft; noticed Reddit only used response_mode=web_message but Apple app still permitted code+id_token with fragment, and that redditmedia.com's GTM jail iframe forwards window.name (including fragment) and executes attacker GTM JS on the same origin.
**Exploitation:** Attacker pre-seeds their own OAuth state, lures victim through a crafted Apple authorize URL with response_mode=fragment so tokens land in reddit.com URL fragment; the redditmedia.com GTM jail iframe (same origin, attacker-controlled GTM container) reads window.name of the popup's redditmedia frame and exfiltrates the code/id_token to the attacker, who then replays the oauthDone postMessage to Reddit to authenticate as the victim.
**Escalation:** Chained OAuth response-mode misconfiguration with a same-origin GTM jail iframe and window.name leakage to convert a one-click link into full account takeover.
**Insight:** When an OAuth client relies on response_mode=web_message, check whether the IdP app still permits other response_type/response_mode combos (code+id_token, fragment) — the redirect_uri then becomes a token sink. Also audit same-origin 'sandbox' iframes like GTM jail that forward window.name or location fragments and run third-party JS.