Collected research

Real-life OIDC Security (II): Login Confusion

Lauritz Holtmann · (Web-)Insecurity Blog · 2 November 2020

Describes Login Confusion: where a service provider honours a post-login redirect parameter and also exposes an unprotected login-initiation endpoint, the victim can be pushed into a silent OpenID Connect flow immediately after typing credentials, ending up logged in as their linked identity provider account instead. Shown on Bitbucket Server.

Record

Researcher

Lauritz Holtmann

Published by

(Web-)Insecurity Blog

Date

2 November 2020

Topic

Other

In the archive

• Collected in the 2020 research round

Tags

• sso
• openid
• oauth
• csrf
• session-fixation
• auth-bypass
• case-study
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Lauritz Holtmann, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.