OAuth Confused Deputy

web · hard · 350 pts

Acme's OAuth provider has a redirect_uri check. Convince it the admin is redirecting to your endpoint, capture the code, redeem the token. --- ### Run locally ```bash cd content/aysec/AYSEC-CTF docker compose up oauth-confused ``` Then open `http://localhost:8000` and start solving.