# [Meetup][World ID][OIDC] Insufficient Filtering of "state" Parameter in Response Mode form_post leads to XSS and ATO

World ID OIDC form_post response mode failed to filter the state parameter, letting attackers inject HTML that exfiltrated users' access tokens via a crafted button.

- Payout: $7,000
- Severity: critical
- Program: Tools for Humanity
- Found by: lauritz
- Disclosed: 2024-06-19
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2515808
- Library page: https://bugbountylibrary.com/r/h1%3A2515808
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:critical tech:oauth tech:oidc technique:source-review vuln:account-takeover vuln:auth-bypass vuln:xss

**Target:** OIDC authentication endpoint (form_post response mode)
**Root cause:** The state parameter was reflected into the form_post HTML response body without proper HTML encoding/validation, allowing injection of HTML elements.
**Steps:**
1. Initiate World ID OIDC auth flow with response_mode=form_post
2. Supply a state value containing HTML markup such as a button/link to attacker site
3. Observe injected HTML rendered in the response body alongside the access token form
4. Victim clicks injected button, sending the access token to attacker-controlled site
**How found:** Researcher examined the form_post response mode handling and noticed the state parameter was reflected into HTML without encoding, then tested HTML injection.
**Exploitation:** Attacker crafts an OIDC authorization request with a malicious state parameter; when the victim completes authentication, the form_post response renders attacker HTML containing a button that submits the access token to an attacker-controlled site upon click.
**Escalation:** Access token theft leads to account takeover of the targeted user.
**Insight:** OIDC form_post responses embed tokens in HTML; any reflected parameter like state in that response is a high-value injection point even when CSP blocks script execution, since HTML injection alone can exfiltrate tokens.