# leaking Digits OAuth authorization to third party websites

Digits OAuth accepted any path/subdomain under fabric.io as callback_url, leaking the OAuth token via referrer to third-party sites linked on the landing page.

- Payout: hidden
- Severity: medium
- Program: X / xAI
- Found by: akhil-reni
- Disclosed: 2017-01-24
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/166942
- Library page: https://bugbountylibrary.com/r/h1%3A166942
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:oauth technique:chained vuln:auth-bypass vuln:info-disclosure

**Target:** OAuth login endpoint (digits.com/login) with callback_url parameter
**Root cause:** The callback_url validation only checked the host (fabric.io) and accepted arbitrary paths/subdomains, so the OAuth token landed on attacker-influenced pages whose outbound links leaked it via the Referer header.
**Steps:**
1. Visit `https://www.digits.com/login?consumer_key=YlNgs6zwm4QLmrzJBwRK3FcR5&callback_url=https://fabric.io/kits/ios/stripe&host=https://fabric.io`
2. Authorize the Digits app
3. Get redirected to `https://fabric.io/kits/ios/stripe` with the token in the URL
4. Click the Stripe website link on that page; the token leaks to stripe.com via Referer
5. Variant: create a crash issue with a note containing an attacker URL, use the issue URL as callback_url, authorize, then click the note link to leak the token to the attacker domain
6. Chained variant: nest a Digits login URL inside callback_url so authorizing the inner app redirects to the attacker site with the token as referrer
**How found:** Noticed during normal Digits login to Fabric that callback_url accepted any path/subdomain under fabric.io, then reasoned that pages under fabric.io containing third-party links would leak the token via Referer.
**Exploitation:** Attacker crafts a Digits login URL whose callback_url points to a fabric.io page containing an attacker-controlled link (kit page, issue note, or nested OAuth). Victim authorizes; the token is placed in the URL of the fabric.io page; when the victim clicks the attacker link, the browser sends the token in the Referer header to the attacker's domain.
**Escalation:** Chaining OAuth callbacks: an outer Digits login with callback_url pointing to another Digits login URL whose callback_url is the attacker site, so two authorizations yield the token delivered to the attacker as referrer.
**Insight:** When an OAuth callback_url is validated only by host, look for any page on that host with attacker-influenceable outbound links (user notes, kit pages, nested OAuth) — the token in the URL leaks via Referer even without XSS.