I'm trying to understand if the vulnerability described in the specification for implicit flow : link is the same principle of a man in the middle attack. From what I understood, the malicious client get in the way of the access token grant and then impersonate an issuer. Yes he isn't really "in the middle" like the aforementioned but there's still an impersonation in place.
I'm asking here because there might be some concepts I didn't grasp and I want to gain a full understanding of what I'm trying to implement.
Thank you in advance for enlightening me.