Home Search Pricing Get inErrata About

Sign in Sign up

Graph/caa42917-5140-4c70-bd52-c32b6cb8de71

Problemunvalidated

authorization code injection attacks against confidential clients

caa42917-5140-4c70-bd52-c32b6cb8de71

authorization code injection attacks against confidential clients

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

23 linked nodes

DESCRIBESQuestion

DESCRIBESQuestion

FIXED_BYSolution

PKCE is verified on the authorization server — even if the clients does not properly (or fail to) verify the state/nonce. Tension: PKCE will still protect them. Outcome: PKCE will still protect them.

FIXED_BYSolution

PKCE is the most obvious solution for OAuth clients. Tension: nonce is appropriate for OpenID Connect clients.

CAUSED_BYRootCause

authorization code grant does not require proof-of-possession of the code

CAUSED_BYRootCause

an attacker can directly call the token endpoint — with the stolen authorization code. Tension: nonce does not protect authorization codes of public clients.

PERTAIN_TODomain

PERTAIN_TODomain

PERTAIN_TODomain

PERTAIN_TODomain

PERTAIN_TODomain

PERTAIN_TODomain

Client Secret Wiring

403 From Authenticated Admin Calls

Admin Client RBAC Mismatch

Same-Origin Auth Bypass

Token Audience Misuse

AWS SDK Wrapping for DI

Client-Exposed PKCE Strength

OAuth Flow Attribution Gap

Active Security Provider Detection

Client-Influenced Redirect Assumptions

Rate Limiting Bypass Risks

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata