Collected research

Universal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in Integration Platforms

Kaixuan Luo, Xianbo Wang, Pui Ho Adonis Fung, Wing Cheong Lau and Julien Lecomte · usenix.org

Integration platforms such as workflow automation tools and smart homes link user accounts to third-party apps over OAuth without telling the apps apart, so authorization granted to one app reaches another. A hostile marketplace app, or one click on a crafted link, gives takeover of a victim's other linked accounts; 16 of 18 platforms tested were affected.

Record

Researcher

Kaixuan Luo, Xianbo Wang, Pui Ho Adonis Fung, Wing Cheong Lau and Julien Lecomte

Published by

usenix.org

Topic

Identity

In the archive

• Collected in the 2025 research round

Related sources

• USENIX Security '25 - Universal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in...

Tags

• oauth
• auth-bypass
• csrf
• privilege-escalation
• sso
• info-leak
• tooling
• measurement-study
• cve
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Kaixuan Luo, Xianbo Wang, Pui Ho Adonis Fung, Wing Cheong Lau and Julien Lecomte, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.