Can someone with OAuth expertise explain this issue in a few more details, as I've read the blog a few times, but still don't understand the actual vulnerability.
From my very limited OAuth knowledge isn't this how it works:
1. The Harvest application asks Microsoft to verify a user.
2. The user is verified by Microsoft.
3. If the user verification is successful Microsoft redirects back to the callback URL, passing back the access token inside the body of the response message.
In this case hasn't the writer of the blog just created a hand-crafted URL so that the return is back to example.com rather than the actual return URL?
From my very limited OAuth knowledge isn't this how it works:
1. The Harvest application asks Microsoft to verify a user. 2. The user is verified by Microsoft. 3. If the user verification is successful Microsoft redirects back to the callback URL, passing back the access token inside the body of the response message.
In this case hasn't the writer of the blog just created a hand-crafted URL so that the return is back to example.com rather than the actual return URL?