# OAuth redirect built from Host header

OAuth or reset redirect target derived from request Host/forwarded host instead of a fixed allowlisted value

_Area: Web authentication and account takeover. Seen in 2 disclosed reports; latest 2018-09-06. Updated 2026-11-01._

## How it works

A security-sensitive URL (OAuth `redirect_uri`, the post-login verifier destination, or a password-reset link) is assembled from the request's `Host` (or `X-Forwarded-Host`) header rather than from a fixed, configured value. The `Host` header is attacker-controlled, so the server mints a link or redirect pointing at the attacker's domain while still carrying a secret: an OAuth verifier/token, a `redirect_token`, or a reset token. The trust boundary breaks because the code treats "the host the request arrived on" as "the host we own."

## Where it shows up

- OAuth login/callback handlers that compute `redirect_uri` or the verifier target from `Host`/`X-Forwarded-Host` [E2](https://bugbountylibrary.com/r/h1%3A317476.md).
- Password-reset or email-link builders that create absolute URLs from the request host [E3](https://bugbountylibrary.com/r/h1%3A281575.md).
- Reverse proxies/load balancers that forward or trust client-supplied host headers into backend routing [E1](https://bugbountylibrary.com/r/blog%3Aseblu-de-2021-12-iap-bypass-html.md).
- Shared OAuth client IDs accepted with an arbitrary secret across tenants [E1](https://bugbountylibrary.com/r/blog%3Aseblu-de-2021-12-iap-bypass-html.md).
- Cookie/token issuance that does not check the token's target host against the requested hostname [E1](https://bugbountylibrary.com/r/blog%3Aseblu-de-2021-12-iap-bypass-html.md).

## How to review

Find every place a redirect target, callback URL, or emailed link is built. The invariant: the destination host must come from a fixed allowlist or configured value, never from request headers. Check that:
- `redirect_uri`/verifier target is compared against an exact allowlist, not derived from `Host` [E2](https://bugbountylibrary.com/r/h1%3A317476.md).
- Reset links use a configured base domain [E3](https://bugbountylibrary.com/r/h1%3A281575.md).
- Issued tokens/cookies are bound to the hostname they were requested for; a mismatch is rejected before issuance [E1](https://bugbountylibrary.com/r/blog%3Aseblu-de-2021-12-iap-bypass-html.md).
- Shared client IDs are validated against a real secret, not accepted with any value [E1](https://bugbountylibrary.com/r/blog%3Aseblu-de-2021-12-iap-bypass-html.md).

## How finders spotted it

- Noticed the login flow's redirect destination tracked the `Host` header, then substituted an attacker host [E2](https://bugbountylibrary.com/r/h1%3A317476.md).
- Observed the reset email link reflected the request `Host`, then spoofed it [E3](https://bugbountylibrary.com/r/h1%3A281575.md).
- After failing a direct bypass, pivoted to credential theft: tried the "shared OAuth client" feature with the victim's client ID and a bogus secret, found the secret unvalidated, and saw an error fire only after the LB forwarded the request, implying the token reached attacker infrastructure first [E1](https://bugbountylibrary.com/r/blog%3Aseblu-de-2021-12-iap-bypass-html.md).

## Variants seen

- OAuth verifier redirected via poisoned `Host` on a login endpoint [E2](https://bugbountylibrary.com/r/h1%3A317476.md).
- Reset-token leak via `Host`-built email link [E3](https://bugbountylibrary.com/r/h1%3A281575.md).
- Cross-org shared OAuth client plus hostname-mismatch cookie issuance, chained into full proxy bypass [E1](https://bugbountylibrary.com/r/blog%3Aseblu-de-2021-12-iap-bypass-html.md).

## Impact and severity

Account takeover via stolen OAuth verifier [E2](https://bugbountylibrary.com/r/h1%3A317476.md) or reset token [E3](https://bugbountylibrary.com/r/h1%3A281575.md); full authentication bypass of a protected app when chained with shared-client and cookie-issuance flaws [E1](https://bugbountylibrary.com/r/blog%3Aseblu-de-2021-12-iap-bypass-html.md). Impact rises with token sensitivity and reach: a single leaked verifier or reset token compromises the account, and chaining minor flaws scaled E1 to bypassing an entire access-control layer.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aseblu-de-2021-12-iap-bypass-html.md
- E2: https://bugbountylibrary.com/r/h1%3A317476.md
- E3: https://bugbountylibrary.com/r/h1%3A281575.md