OAuth Authorization Bypass Testbed

# Client Application  (front-end that initiates the OAuth flow)
https://403.brutelogic.net/authz/oauth/login                         # Sign-in page, exposes the client-id
                                                                     # Flow is vulnerable to a random technique

# Authorization Server  (per-technique test endpoints)
https://403.brutelogic.net/authz/oauth/response-mode                 # Response Mode Escape
https://403.brutelogic.net/authz/oauth/state?technique=missing       # Missing State
https://403.brutelogic.net/authz/oauth/state?technique=static        # Static State
https://403.brutelogic.net/authz/oauth/state?technique=predictable   # Predictable State
https://403.brutelogic.net/authz/oauth/pkce?technique=plain          # S256->plain Downgrade
https://403.brutelogic.net/authz/oauth/pkce?technique=noverifier     # No Verifier Check
https://403.brutelogic.net/authz/oauth/pkce?technique=nochallenge    # No Challenge Check
https://403.brutelogic.net/authz/oauth/pkce?technique=confidential   # Confidential Client Downgrade
https://403.brutelogic.net/authz/oauth/aud-validation                # Missing aud Validation
https://403.brutelogic.net/authz/oauth/race                          # OAuth Singleton Race Condition
https://403.brutelogic.net/authz/oauth/prompt-none                   # prompt=none Silent Redirect
https://403.brutelogic.net/authz/oauth/register                      # DCR Open Registration → Unauthorized Client
https://403.brutelogic.net/authz/oauth/token/mfa                     # Grant Type Substitution -> MFA Bypass
https://403.brutelogic.net/authz/oauth/token/authmethod              # Auth Method Confusion
https://403.brutelogic.net/authz/oauth/token/replay                  # Code Replay
https://403.brutelogic.net/authz/oauth/token/scope                   # Scope Creep at Refresh
https://403.brutelogic.net/authz/oauth/token/resource                # Resource Indicator Omission

© 2026 Brute Logic — All rights reserved.