The vulnerability came from the outlook-integration.harvestapp.com. It used a JSON object as `state` containing instructions once the OAuth2 Callback succeeded.
The property `subdomain` was used to redirect the browser to a subdomain of harvestapp.com, passing the `#id-token`. The problem came from the fact that the value of `subdomain` was injected directly to:
The property `subdomain` was used to redirect the browser to a subdomain of harvestapp.com, passing the `#id-token`. The problem came from the fact that the value of `subdomain` was injected directly to:
https://${subdomain}.harvestapp.com/...#id-token=...
By setting the `subdomain` in JSON payload to `attacker-controlled.com/` (note the trailing slash), the URL become:
..thus redirects the browser to another domain, leaking the token.