OAuth Authentication Vulnerabilities

Cross-platform resources for OAuth Authentication Vulnerabilities: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice OAuth Authentication Vulnerabilities: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 8 challenges across 3 platforms — 1 HackTheBox · 6 PortSwigger · 1 TryHackMe. 1 with a Spanish writeup, 1 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Authentication bypass via OAuth implicit flow (Apprentice) · 🇬🇧
2. PortSwigger — Stealing OAuth access tokens via a proxy page (Apprentice) · 🇬🇧
3. PortSwigger — Forced OAuth profile linking (Practitioner) · 🇬🇧
4. PortSwigger — OAuth account hijacking via redirect_uri (Practitioner) · 🇬🇧
5. PortSwigger — SSRF via OpenID dynamic client registration (Practitioner) · 🇬🇧
6. PortSwigger — Stealing OAuth access tokens via an open redirect (Practitioner) · 🇬🇧

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/oauth

HTB machines practicing OAuth Authentication Vulnerabilities (1)

Machine	OS	Difficulty	Writeup
Oouch	Linux	HARD	🇪🇸 🇬🇧 📹

PortSwigger labs practicing OAuth Authentication Vulnerabilities (6)

Lab	Difficulty	Topic	Official
Authentication bypass via OAuth implicit flow	APPRENTICE	OAuth Authentication	Open
Stealing OAuth access tokens via a proxy page	APPRENTICE	OAuth Authentication	Open
Forced OAuth profile linking	PRACTITIONER	OAuth Authentication	Open
OAuth account hijacking via redirect_uri	PRACTITIONER	OAuth Authentication	Open
SSRF via OpenID dynamic client registration	PRACTITIONER	OAuth Authentication	Open
Stealing OAuth access tokens via an open redirect	PRACTITIONER	OAuth Authentication	Open

TryHackMe rooms practicing OAuth Authentication Vulnerabilities (1)

Room	Difficulty	Type	Access	Official
OAuth Vulnerabilities	MEDIUM	Walkthrough	🔵 VIP	Open

---

← Back to the full glossary

Last updated: 2026-08-17