# XSS on OAuth authorize/authenticate endpoint

Twitter OAuth authorize/authenticate page failed to sanitize oauth_callback, allowing reflected XSS via a crafted request token in browsers without CSP.

- Payout: hidden
- Severity: medium
- Program: X / xAI
- Found by: filedescriptor
- Disclosed: 2015-11-20
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/87040
- Library page: https://bugbountylibrary.com/r/h1%3A87040
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:oauth vuln:xss

**Target:** OAuth authorize/authenticate endpoint on twitter.com and api.twitter.com
**Root cause:** The redirection page after authorization/authentication reflects the oauth_callback parameter without sanitization, allowing HTML/script injection.
**Steps:**
1. Request a token at `https://api.twitter.com/oauth/request_token` with `oauth_callback` containing HTML such as `javascript%3A%2F%2F"><script>alert(document.domain)</script>`
2. Redirect the victim to the authorize/authenticate page with that token
3. Victim clicks 'Authorize app' and the script executes (in a browser without CSP, e.g. IE)
**How found:** Noticed the post-authorization redirect page reflected the oauth_callback parameter and tested injecting HTML/script into it.
**Exploitation:** Attacker obtains a request token with a malicious oauth_callback, sends the victim to the authorize page; upon clicking Authorize the callback value is reflected unsanitized and script runs in the twitter.com origin.
**Insight:** OAuth callback parameters are often reflected on the post-consent redirect page; test injecting HTML into oauth_callback at request_token time and check execution on the authorize page, especially in browsers lacking CSP.