> For the complete documentation index, see [llms.txt](https://utkarsh24122.gitbook.io/findings/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://utkarsh24122.gitbook.io/findings/oauth-misconfiguration.md). # OAuth Misconfiguration See how I found an OAuth misconfiguration escalated to pre authentication account takeover without Burpsuite or any other tool. Modern Web And Android Apps use OAuth for easy authentication. I won't go into what it is and how it works because I have already shared the related learning resources in my Linkedin post : [Click here](https://www.linkedin.com/posts/utkarsh24122_websecurity-bugbounty-bugs-activity-6799341722955522048-IsvA) ! I have found various typical cases such as "missing state parameter" , "improper redirect\_uri validation" and others that one can learn from Portswigger's Web Security Academy . So I won't discuss those here. Rather I will show how I found a logical flaw in the web app's OAuth implementation which is not described in Portswigger's article. One of the public programs on Bugcrowd was using google OAuth. I tested the basic test cases but the functionality was quite well implemented. However I noticed that immediate 'Email verification was not required to create an account. I am putting the screenshots from the report so that I dont have to explain the impact here again 🤪. ![Description](https://929906876-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-McdN2X0veTENxx9JlEB%2F-MhqvBNZnTkf_D6riXHB%2F-MhrGZDw-JgRD8OVTUIG%2Fimage.png?alt=media\&token=a4aebdaa-4652-4b35-be99-f7318d61f97d) ![Impact](https://929906876-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-McdN2X0veTENxx9JlEB%2F-MhqvBNZnTkf_D6riXHB%2F-MhrQUFQegkGcLhlKoyR%2Fimage.png?alt=media\&token=895b2ec3-036e-49d6-80d2-d1b1a762afb3) I did some more research about this and found this amazing blog by [@harshbothra\_](https://twitter.com/harshbothra_) :\ \