Collected research

SSO Gadgets: Escalate (Self-)XSS to ATO

Lauritz Holtmann · (Web-)Insecurity Blog · 4 February 2023

OAuth2/OIDC clients that still permit the implicit flow, omit PKCE, or run as public single-page apps give an attacker with script execution on the app's origin a way to mint a fresh access_token through a prompt=none popup window. That turns any XSS, including a Self-XSS combined with Login CSRF, into full account takeover; Google's web-application clients could not disable implicit at the time.

Record

Researcher

Lauritz Holtmann

Published by

(Web-)Insecurity Blog

Date

4 February 2023

Topic

XSS

In the archive

• Collected in the 2023 research round

Tags

• oauth
• sso
• xss
• csrf
• openid
• auth-bypass
• gadget-chain
• session-fixation
• owasp-a01-2021
• owasp-a03-2021
• owasp-a07-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Lauritz Holtmann, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.