CloudPulse — OAuth CSRF Account Takeover via Missing State Parameter

hackadvisor

Task: Express.js cloud monitoring platform with ConnectID SSO integration, admin bot visits support ticket URLs. Solution: OAuth CSRF via missing state parameter — register attacker ConnectID, capture authorization code, deliver callback URL to admin via support ticket, admin bot links attacker's ConnectID to admin account, then login as admin via ConnectID.