OBroken

TOOL  |  EXCLUSIVE — BRUTE ONE  |  OAUTH  |  AUTHORIZATION BYPASS  |  BUG BOUNTY

OBroken — OAuth Authorization Bypass Scanner

The first tool to autonomously find, exploit and prove OAuth authorization bypasses end to end. One URL in, a complete Find/Forge/Fire PoC out — ready to report and collect.

OAuth & Its Attack Surface

OAuth 2.0 is the dominant authorization framework powering login flows across the web. Every "Sign in with Google", "Continue with GitHub" button, every mobile app that authenticates without a password, every API that delegates access to a third party — these all run on OAuth.

Its ubiquity makes it one of the highest-value targets in bug bounty. A single authorization bypass can mean full account takeover, cross-account data access, or silent session hijacking with no user interaction required.

Despite its prevalence, OAuth is consistently misconfigured in production. The specification is large, implementations vary widely, and the attack surface spans both the Authorization Server and the client application. Common flaws include weak or missing state parameters leaving users exposed to CSRF, PKCE protections that exist in name only, tokens accepted by APIs that were never intended to receive them, and authorization codes that can be replayed or redirected to attacker-controlled endpoints.

These are not theoretical. They are found, reported and paid — regularly.

For the full technical breakdown of OAuth authorization bypass techniques, see our ebook: Broken Token: OAuth.

What OBroken Does

OBroken is a proprietary OAuth Authorization Bypass Scanner, exclusive to Brute One. It takes a single URL — a client app login page or an OAuth authorize endpoint — and autonomously runs 23 techniques across 17 vulnerability classes against the target's authorization flow.

No manual configuration required. No pre-existing knowledge of the target's OAuth setup. The tool discovers everything it needs from the entry URL and produces a standalone, executable proof of concept for every vulnerability it confirms.

Part of the Broken Token series
OBroken is the OAuth sibling of JBroken, our JWT Authorization Bypass Scanner with 40+ techniques. Same methodology, same output format, same FFF PoC structure — different protocol layer. Together they cover the full token-based authorization attack surface.

How It Works

1. Acquisition

Given a URL, OBroken autonomously acquires everything needed to test the target. It scrapes the client app for the authorize link, extracts the client_id and redirect_uri, runs split-origin AS discovery for apps where the client and authorization server live on different domains, probes common paths for leaked client_secret values, and derives the protected API endpoint from the OIDC discovery document.

$ obroken https://app.target.com/login

obroken v1.0 by Brute Logic - https://brutelogic.net

Preflight
  [✓] Discovery document found
  [✓] client_id acquired via scraped client app
  [✓] API endpoint: https://api.target.com/v1/me (discovered)
  [✓] Authorization required confirmed

Running techniques...
  Trying: Missing State...

2. Technique Sweep

With the target profiled, OBroken runs its full technique sweep. Each technique follows the FFF methodology: Find confirms the vulnerability exists, Forge builds the exploit, Fire proves impact against the protected resource. No technique is marked as found without a token that successfully accesses the API.

3. Output

Every confirmed vulnerability produces a complete, standalone PoC. Find, Forge and Fire steps are printed in full, followed by a single executable curl command with a real Bearer token captured during the run. Copy, paste, submit.

Vulnerability Coverage

OBroken tests 23 techniques across 17 OAuth vulnerability classes. Coverage spans both the Authorization Server and the client application layer.

  • State & CSRF protection flaws
  • PKCE implementation weaknesses
  • Token audience & resource validation
  • Authorization code vulnerabilities
  • Client registration & authentication
  • Session & timing vulnerabilities

Each vulnerability class maps directly to real CVEs and documented real-world findings. The technique list is not published — OBroken is a proprietary tool, exclusive to Brute One subscribers.

Brute One Integration

OBroken runs natively inside Brute One. No command line required. Ask Brute One to check a target for OAuth vulnerabilities and it handles the rest — tool selection, execution, and AI-powered analysis of the results.

user >> check this for OAuth https://app.target.com/login

BRUTE-1  Confirm to run obroken https://app.target.com/login? (y/N)

user >> y

BRUTE-1  Running tool, please wait... [3]

Results appear in the Tool Output panel alongside PoC and/or Brute One's AI analysis of the findings with vulnerability context.

Testbed

OBroken was developed and validated against a purpose-built OAuth Authorization Bypass Testbed available at 403.brutelogic.net/authz/oauth/. The testbed exposes a fully functional OAuth flow with deterministic vulnerability injection per technique, allowing reproducible validation of every bypass class the tool covers.

Hunters can use the testbed independently to study OAuth authorization bypass techniques hands-on before applying them to real targets.

Access

OBroken is not publicly available. It is an exclusive feature of Brute One, our AI-powered bug bounty platform. Access requires an active Brute One subscription.

Tags: OAuth 2.0  •  OpenID Connect  •  Authorization Bypass  •  CVE-2025-9803  •  Broken Token Series