## https://sploitus.com/exploit?id=C98BC0CD-A13C-5EB2-A457-8E6D8C27AF33
Security Research
OAuth / OIDC and auth-logic vulnerability research — writeups, root-cause analysis, and PoCs.
GitHub ·
Portfolio ·
LinkedIn ·
CTFtime
---
I break authentication systems used by millions, then help ship the fixes. My day job is authorized web and API pentesting as a VAPT engineer. The rest of the time I audit open-source auth frameworks and report what I find.
Most of my bugs are the kind a scanner walks straight past: OAuth/OIDC flaws, auth bypasses, broken access control, business-logic abuse. I find them by reading the code and proving them with a working PoC, then writing the fix up the way a developer actually wants to read it.
This repo is where those writeups live. Each one walks the root cause, the exploit path, and the fix, from the source up.
## Published findings
| Target | Bug | Severity | Writeup | Advisory |
|---|---|---|---|---|
| **better-auth** | OAuth refresh-token replay, missing client auth on the refresh grant | **Critical · 9.1** | [Read](writeups/better-auth-refresh-token-replay.md) | [CVE-2026-53512](https://github.com/advisories/GHSA-pw9m-5jxm-xr6h) |
| **better-auth** | OIDC `alg=none` advertised + silent PKCE downgrade | **High · 8.7** | [Read](writeups/better-auth-oidc-algnone-pkce-downgrade.md) | [GHSA-9h47-pqcx-hjr4](https://github.com/advisories/GHSA-9h47-pqcx-hjr4) |
| **n8n** | OAuth authorization bypass, missing state-param ownership check | Medium | [Read](writeups/n8n-oauth-state-bypass.md) | [CVE-2026-33720](https://nvd.nist.gov/vuln/detail/CVE-2026-33720) |
| **oauth2-server** | `redirect_uri` validation flaw | Medium · 5.4 | [Read](writeups/oauth2-server-redirect-uri.md) | [SNYK-JS-OAUTH2SERVER-3009137](https://security.snyk.io/vuln/SNYK-JS-OAUTH2SERVER-3009137) |
| **SAP** | Server-side finding via source review | recognized | — | [SAP Security Hall of Fame, 2026](https://www.sap.com/about/trust-center/security/incident-management.html) |
## Private-program findings
Same class of work, under NDA, so no vendor names or identifying detail:
- **In-tenant account takeover via attribute-mapping abuse** — a config-only OIDC change rewrites arbitrary in-tenant users' email, locking them out and persisting past IdP revocation.
- **OIDC SSRF reaching internal services** — an unvalidated issuer field on an identity-provider create endpoint turns into an internal port scanner and loopback reach with no auth filter.
- **Broken OAuth redirect and authorization chains** across public and private bug-bounty programs.
Full writeups for these go up if and when the programs allow disclosure.
## The kind of thing I look for
`oauth / oidc identity flaws` · `auth bypasses` · `broken access control` · `business-logic abuse` · `cross-protocol and legacy/modern endpoint edges`
All of it manual, from reading source. Scanners don't find these.
---
Reach me through my portfolio or LinkedIn.