Universal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in Integration Platforms

Kaixuan Luo, Xianbo Wang, Pui Ho Adonis Fung, Wing Cheong Lau, Julien Lecomte

34th USENIX Security Symposium · Day 1

This article delves into the critical security vulnerabilities discovered in **integration platforms** that leverage **OAuth 2.0** for **account linking**. The paper, authored by Kaixuan Luo and Xianbo Wang from The Chinese University of Hong Kong, alongside Pui Ho Adonis Fung and Julien Lecomte from Samsung Research America, unveils two novel platform-wide attack classes: **Cross-app OAuth Account Takeover (COAT)** and **Cross-app OAuth Request Forgery (CORF)**. These attacks exploit flawed designs in how these platforms manage multi-app OAuth authorizations, particularly a lack of proper app differentiation.

AI review

This is real research. Novel attack classes against OAuth in integration platforms, systematic methodology, 16/18 major platforms vulnerable including Microsoft (CVE-2023-36019, CVSS 9.6), and they got it all patched. The kind of work that changes how an entire class of systems gets built.