When we click the "Single Sign On" button, the plugin redirects us to the OAuth server to authenticate ourselves if we are not logged in.

The button invokes the following URL:

The client plugin redirects us to the following URL:

The URL contains the "client_secret" code that can be used to request an access token with client credentials grant type authentication.

Exploit script: