Critical API Security Vulnerabilities Found in OAuth Implementations of Popular Platforms

Salt Security’s recent research has uncovered critical API security vulnerabilities in the OAuth protocol implementations of widely used online platforms such as Grammarly, Vidio, and Bukalapak. These vulnerabilities, although now addressed, had the potential to compromise user credentials and enable full account takeovers, posing risks to billions of users.

Background on OAuth Hijacking Series

This research paper by Salt Labs marks the final chapter in their OAuth hijacking series, building upon their earlier discoveries of vulnerabilities in platforms like Booking.com and Expo. These flaws presented severe risks, including granting cybercriminals unrestricted access to user accounts, potentially resulting in unauthorized access to sensitive financial and personal information.

Impact on Users

The identified vulnerabilities exposed users to potential identity theft and financial fraud. Cyber attackers could insert a token from another site as a verified token, a technique known as a “Pass-The-Token Attack.” This technique, made possible due to the security flaws in OAuth implementations, enabled hackers to gain unauthorized access to user accounts and sensitive information, jeopardizing user privacy and security.

The platforms mentioned in the Salt Security report, namely Vidio, Bukalapak, and Grammarly, swiftly responded to the research findings and took necessary actions to resolve the security vulnerabilities raised by the researchers at Salt Labs. By addressing these vulnerabilities promptly, the platforms have demonstrated their commitment to user security and protection.

The Scale of the Issue

According to Balmas, a representative from Salt Security, the impact of these vulnerabilities was substantial, potentially affecting over a billion users. The significance of these findings cannot be overstated, as users’ accounts could have been breached had the vulnerabilities been discovered by malicious actors rather than by Salt Labs’ researchers. The proactive actions taken by the affected platforms are commendable, as they helped prevent widespread security incidents.

Introduction to OAuth and Its Design

OAuth is a widely adopted technology that simplifies the sign-in process by allowing users to log in to websites using their social media accounts. It is crucial to note that the research findings do not indicate inherent flaws in the OAuth protocol itself. In fact, OAuth is well-designed and does not exhibit obvious fail points. The flaws discovered by Salt Labs were in the specific implementations of OAuth on the affected platforms.

The research conducted by Salt Security sheds light on critical API security vulnerabilities in the OAuth protocol implementations of popular online platforms. The prompt actions taken by the affected platforms, such as Vidio, Bukalapak, and Grammarly, after being alerted by Salt Labs’ researchers, demonstrate their commitment to user security. As OAuth continues to be a widely adopted technology for user authorization and authentication, these findings highlight the importance of continuous security improvements in online platforms to safeguard user data and protect against potential unauthorized access or data breaches.

It is crucial for both developers and organizations to prioritize ongoing vulnerability assessments and robust security measures in their OAuth implementations. By doing so, they can ensure the safety and privacy of user accounts and prevent potential risks such as identity theft and financial fraud. As the digital landscape continues to evolve, it is imperative that security practices and technologies also evolve to keep pace with emerging threats, ultimately providing users with a secure online experience.

Explore more

How Will ICP’s Solana Integration Transform DeFi and Web3?

The collaboration between the Internet Computer Protocol (ICP) and Solana is poised to redefine the landscape of decentralized finance (DeFi) and Web3. Announced by the DFINITY Foundation, this integration marks a pivotal step in advancing cross-chain interoperability. It follows the footsteps of previous successful integrations with Bitcoin and Ethereum, setting new standards in transactional speed, security, and user experience. Through

Certificial Launches Innovative Vendor Management Program

In an era where real-time data is paramount, Certificial has unveiled its groundbreaking Vendor Management Partner Program. This initiative seeks to transform the cumbersome and often error-prone process of insurance data sharing and verification. As a leader in the Certificate of Insurance (COI) arena, Certificial’s Smart COI Network™ has become a pivotal tool for industries relying on timely insurance verification.

Why Choose IT Operations Over Software Development?

Choosing Between IT Operations and Software Development In today’s rapidly evolving technology landscape, career decisions in the tech field often boil down to choosing between IT operations and software development. While software development is often celebrated for its high salaries and abundance of job opportunities, IT operations offer a compelling alternative that goes beyond financial considerations. The assumption that software

Wix and ActiveCampaign Team Up to Boost Business Engagement

In an era where businesses are seeking efficient digital solutions, the partnership between Wix and ActiveCampaign marks a pivotal moment for enhancing customer engagement. As online commerce evolves, enterprises require robust tools to manage interactions across diverse geographical locations. This alliance combines Wix’s industry-leading website creation and management capabilities with ActiveCampaign’s sophisticated marketing automation platform, promising a comprehensive solution to

Top Cryptocurrencies to Watch in June 2025 for Smart Investments

Cryptocurrencies continue to reshape financial markets and offer intriguing investment opportunities for those astute enough to navigate this rapidly evolving sector. Each month, the crypto landscape introduces new contenders and reinforces existing favorites that demonstrate potential through unique value propositions and market traction. Understanding the intricacies behind these developments is crucial for investors deliberating their next move in the digital