# Unbound token claims enable impersonation

Is the token, code, or identity claim bound server-side to the target user or object at redemption?

_Area: Web authentication and account takeover. Seen in 13 disclosed reports; 9 confirmed bounties, median $6,250, range $560-$100,000; latest 2026-10-20. Updated 2026-10-23._

## How it works
A token, code, or identity claim is issued for one principal but accepted for another. At the point where access is granted, the server trusts a client-supplied value (email, phone, resource id, client_id, installation_id, or a claim inside a signed token) instead of checking that the value was bound to the authenticated principal when the token was minted. The assumption that breaks: that the identifier presented at redemption is the same one the token was issued for. Nothing enforces that link, so any holder can redirect the token to a target they do not own. This differs from plain IDOR: the object reference is legitimate, but the credential-to-target binding is missing.

## Where it shows up
- Redemption/verify endpoints that accept an email, phone, resource id, or tenant/installation id as a parameter [E2](https://bugbountylibrary.com/r/h1%3A242765.md)[E7](https://bugbountylibrary.com/r/h1%3A1330529.md)
- OAuth/device-code flows where client_id, scope, or a session blob travels in a URL and is re-read at consent [E1](https://bugbountylibrary.com/r/blog%3Aweirdmachine64-github-io-research-google-oauth-device-code-hijacking-html.md)
- Federated identity token minting that accepts an arbitrary email/sub in the request [E4](https://bugbountylibrary.com/r/blog%3Abhavukjain-com-blog-2020-05-30-zeroday-signin-with-apple.md)
- Certificate or token extensions carrying a username that downstream services trust [E5](https://bugbountylibrary.com/r/h1%3A1901040.md)
- Lifecycle endpoints that accept a context JWT without validating its binding claim (e.g. qsh) [E8](https://bugbountylibrary.com/r/bc%3Aad5e53a0-d477-4dc9-8bda-4ec8d702364f.md)
- Adjacent: flows where the code/OTP is not consumed or re-bound before use [E3](https://bugbountylibrary.com/r/h1%3A4035023.md)[E7](https://bugbountylibrary.com/r/h1%3A1330529.md)

## How to review
The invariant: the identity or object a token grants access to must be fixed at issuance and re-derived server-side at redemption, never taken from the request. Check that the verify endpoint looks up the stored binding (token -> email/phone/resId/principal) and compares it to the target, rather than using the request parameter to select the target [E2](https://bugbountylibrary.com/r/h1%3A242765.md)[E7](https://bugbountylibrary.com/r/h1%3A1330529.md). For OAuth/device-code, confirm client_id/scope are validated against the stored device_code server-side and the session URL is not portable [E1](https://bugbountylibrary.com/r/blog%3Aweirdmachine64-github-io-research-google-oauth-device-code-hijacking-html.md). For signed tokens, confirm the claim matches the authenticated principal at every downstream consumer [E4](https://bugbountylibrary.com/r/blog%3Abhavukjain-com-blog-2020-05-30-zeroday-signin-with-apple.md)[E5](https://bugbountylibrary.com/r/h1%3A1901040.md). For lifecycle JWTs, confirm the binding claim is validated before acting [E8](https://bugbountylibrary.com/r/bc%3Aad5e53a0-d477-4dc9-8bda-4ec8d702364f.md).

## Variants seen
- Invite token not bound to email; login target taken from request [E2](https://bugbountylibrary.com/r/h1%3A242765.md)
- OTP verified for attacker's resource, applied to victim's resId [E7](https://bugbountylibrary.com/r/h1%3A1330529.md)
- Device-code session portable via URL with swapped client_id/scope [E1](https://bugbountylibrary.com/r/blog%3Aweirdmachine64-github-io-research-google-oauth-device-code-hijacking-html.md)
- Federated id_token minted for arbitrary email [E4](https://bugbountylibrary.com/r/blog%3Abhavukjain-com-blog-2020-05-30-zeroday-signin-with-apple.md)
- SSH cert login extension trusted without principal check [E5](https://bugbountylibrary.com/r/h1%3A1901040.md)
- Context JWT replayed without qsh validation to rewrite baseurl [E8](https://bugbountylibrary.com/r/bc%3Aad5e53a0-d477-4dc9-8bda-4ec8d702364f.md)
- Adjacent: OTP/code not re-bound between send and verify [E3](https://bugbountylibrary.com/r/h1%3A4035023.md)[E7](https://bugbountylibrary.com/r/h1%3A1330529.md)

## Impact and severity
Full account takeover and cross-tenant data access [E1](https://bugbountylibrary.com/r/blog%3Aweirdmachine64-github-io-research-google-oauth-device-code-hijacking-html.md)[E2](https://bugbountylibrary.com/r/h1%3A242765.md)[E4](https://bugbountylibrary.com/r/blog%3Abhavukjain-com-blog-2020-05-30-zeroday-signin-with-apple.md)[E5](https://bugbountylibrary.com/r/h1%3A1901040.md)[E7](https://bugbountylibrary.com/r/h1%3A1330529.md)[E8](https://bugbountylibrary.com/r/bc%3Aad5e53a0-d477-4dc9-8bda-4ec8d702364f.md). Bounty median 6250, range 560-100000. Worse when identifiers are enumerable or flows are multi-step, widening the window between issue and redeem.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aweirdmachine64-github-io-research-google-oauth-device-code-hijacking-html.md
- E2: https://bugbountylibrary.com/r/h1%3A242765.md
- E3: https://bugbountylibrary.com/r/h1%3A4035023.md
- E4: https://bugbountylibrary.com/r/blog%3Abhavukjain-com-blog-2020-05-30-zeroday-signin-with-apple.md
- E5: https://bugbountylibrary.com/r/h1%3A1901040.md
- E6: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2022-device-code-phishing.md
- E7: https://bugbountylibrary.com/r/h1%3A1330529.md
- E8: https://bugbountylibrary.com/r/bc%3Aad5e53a0-d477-4dc9-8bda-4ec8d702364f.md