oauth-oidc-misconfiguration
oauth oidc misconfiguration
What it does
- The app supports Login with Google, GitHub, Microsoft, Okta, or other IdPs
- You see authorize, callback, redirecturi, code, state, nonce, or codechallenge
- Mobile or SPA clients rely on OAuth or OIDC flows
- jwt oauth token attacks
- CORS or cross-origin token exposure: cors cross origin misconfiguration
- XML federation or enterprise SSO: saml sso assertion attacks
- CSRF-heavy login or binding bugs: csrf cross site request forgery
Requirements & configuration
- SKILL: OAuth and OIDC Misconfiguration — Redirects, PKCE, Scopes, and Token Binding
- For token cryptography and JWT header abuse, also load:
- jwt oauth token attacks
- | OIDC nonce | missing or not validated on ID token return |
- | token audience and issuer | weak aud / iss checks, cross-client token reuse |
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
oauth-oidc-misconfiguration FAQ
What does the oauth-oidc-misconfiguration skill do?
>- OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding, and identity-provider trust flaws. The app supports Login with Google, GitHub, Microsoft, Okta, or other IdPs You see authorize, callback, redirecturi, code, state, nonce, or codechallenge
What does oauth-oidc-misconfiguration require?
SKILL: OAuth and OIDC Misconfiguration — Redirects, PKCE, Scopes, and Token Binding For token cryptography and JWT header abuse, also load: jwt oauth token attacks | OIDC nonce | missing or not validated on ID token return | | token audience and issuer | weak aud / iss checks, cross-client token reuse |
How do I install oauth-oidc-misconfiguration?
Run: npx -y skills add https://github.com/yaklang/hack-skills --skill oauth-oidc-misconfiguration --agent claude-code — the source lives at github.com/yaklang/hack-skills.
Maintain oauth-oidc-misconfiguration?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[oauth-oidc-misconfiguration on getagentictools](https://getagentictools.com/skills/yaklang-hack-skills-oauth-oidc-misconfiguration?ref=badge) npx agentictools info skills/yaklang-hack-skills-oauth-oidc-misconfiguration The second line is the CLI lookup for this page — handy in READMEs and docs.
