As described here: https://tools.ietf.org/id/draft-ietf-oauth-security-topics-13.html#proposed-countermeasures-2

Note on pre-warmed secrets: An attacker can circumvent the countermeasures described above if he is able to create or capture the respective secret or code_challenge on a device under his control, which is then used in the victim's authorization request.

1 Answer 1


It seems like the author intended to describe an attack whereby the attacker gains control over the secret and pre-generates a token before tricking the user into using it. In this context the attacker would know the next token that the user was going to generate for an authentication event. That said, it's not particularly clear, and I may be wrong.

Either way, that language was removed from later revisions of the draft, and it's now on version 18.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .