# Tokens from services like Facebook can be stolen

cb.html reads access_token/token/code from URL and postMessages it to any opener via '*', letting an attacker page steal Facebook OAuth tokens and log into Badoo.

- Payout: hidden
- Severity: high
- Program: Bumble
- Found by: stefanovettorazzi
- Disclosed: 2016-06-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/92472
- Library page: https://bugbountylibrary.com/r/h1%3A92472
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:oauth technique:source-review vuln:account-takeover vuln:auth-bypass vuln:info-disclosure

**Target:** OAuth callback page mus1.badoo.com/cb.html
**Root cause:** The callback page extracts token parameters from the URL and forwards them with window.opener.postMessage(message, '*'), so the browser delivers the token to whatever page opened the window, not just the legitimate origin.
**Steps:**
1. Visit https://mus1.badoo.com/cb.html and note it reads `_access_token_`, `_token_`, `_code_` from the URL.
2. Observe it calls `window.opener.postMessage(message, '*');` with the token value.
3. Host an attacker page (opener.html) that opens the cb.html URL with a token in the query string.
4. Add a message listener on the attacker page to capture the postMessage payload.
5. Sign up to Badoo via Facebook, open the attacker page while logged into Facebook, click the button, and read the leaked Facebook token for Badoo.
**How found:** Reading cb.html source and noticing the wildcard targetOrigin in postMessage combined with token parameters taken from the URL.
**Exploitation:** Attacker lures a logged-in Facebook/Badoo user to an attacker-controlled page that opens the cb.html callback URL; cb.html postMessages the token to the opener with '*' wildcard, and the attacker page captures it and uses it to log into Badoo as the victim.
**Insight:** OAuth callback/redirect helper pages that relay tokens via postMessage with '*' are a token-theft primitive: any page that can open them as a popup receives the token. Grep callback endpoints for postMessage(..., '*') and token/code query parsing.