https://weirdmachine64.github.io Security research, vulnerability writeups, and responsible disclosure by Mohamed Benchikh.Thu, 16 Jul 2026 14:48:38 GMT https://weirdmachine64.github.io/research/google-oauth-device-code-hijacking.html https://weirdmachine64.github.io/research/google-oauth-device-code-hijacking.htmlRFC 8628's device authorization grant lets a TV or CLI "poll" for login on a second screen. On Google's implementation, the entire session was transferable across browsers, the authorization server never checked that the client_id and scope in the consent URL matched the ones the device_code was issued for, and prompt=none turned the whole thing into a one-click, invisible account takeover.https://weirdmachine64.github.io/research/google-cloud-ato-url-parsing.html https://weirdmachine64.github.io/research/google-cloud-ato-url-parsing.htmlA unique OAuth account takeover affecting several Google services. URL parsing confusion in the redirect_uri parameter meant the payload http://[::1]@[::1]@attacker.com let me impersonate first-party clients like the gcloud CLI and leak the victim's access token to my server, with almost zero visibility to the victim.