There is an API that openly returns client_secret for each existing user, as long as you pass an email address.

Is that a vulnerability?

What are the risks?


Yes, the client_secret is designed, as the name might imply, to be secret.

This article from the OAuth website illustrates this:

The client_secret is a secret known only to the application and the authorization server. It must be sufficiently random to not be guessable, [...]

It is critical that developers never include their client_secret in public (mobile or browser-based) apps.

Emphasis mine

An oversimplified view is that the client_id is like a username, and the client_secret is like the password. An API that prints my password when giving it my e-mail address is...bad. Very bad.

|improve this answer|||||
  • Can you please help me understand what happens after an attacker gets his hands on someone's client_id and client_secret? Login endpoint uses username and password for authentication, so what do leaked client id and secret do? – Alph.Dev May 16 '19 at 21:32
  • Whatever you do with client_secret is your task to find out. It seems to me that your "interpretation" of OAuth has very little to do with the concept of what OAuth was supposed to be. – MechMK1 May 17 '19 at 7:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.