Security issue

[MartinMystikJonas]

I just stumbled upon this article about possible security issue in OAuth2 implementations: https://salt.security/blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts

It seems to me this implementation is also vulberable to this attack.

[MartinMystikJonas]

FAcebook, Google etc. would return resource owner data even for token generated for another app. So atacker can use token generated for logging user to his app to login to user account on another apps that does not explicitly validate that token is generated for them.

[ramsey]

It seems to me this implementation is also vulberable to this attack.

Can you illustrate how this implementation is vulnerable to attack? I have turned on the ability to report security vulnerabilities to this repository, allowing you to report vulnerabilities and provide sensitive information without revealing how to exploit the vulnerabilities to bad actors.

You may submit a report with more details here: https://github.com/thephpleague/oauth2-client/security/advisories/new

Thanks!