Title
Recovery/invite magic-link token leakage via URL fragment
Target
kurs.onecode.de (/einladung, /passwort-neu handoff)
Class
OATH
Confidence
42/100
Reasoning
HashSessionHandoff places live Supabase access_token+refresh_token in URL # and calls setSession client-side. Redirect target is fixed whitelist (no open redirect) so token capture needs a secondary leak (XSS, external hash-reader) not yet demonstrated.
Evidence needed
mechanism on handoff path reading/sending location.hash to attacker-controlled destination, or XSS/DOM sink on handoff.
Verify steps
(post-auth) complete recovery/invite flow while monitoring for requests carrying the hash token, external network calls, or DOM sinks reflecting hash content.
Impact
session-token theft -> full ATO (High)
Testability
AUTH_HELPED
model: bigpickle · auto-synced from leads/lead-*.md
Title
Recovery/invite magic-link token leakage via URL fragment
Target
kurs.onecode.de (/einladung, /passwort-neu handoff)Class
OATH
Confidence
42/100
Reasoning
HashSessionHandoff places live Supabase access_token+refresh_token in URL # and calls setSession client-side. Redirect target is fixed whitelist (no open redirect) so token capture needs a secondary leak (XSS, external hash-reader) not yet demonstrated.
Evidence needed
mechanism on handoff path reading/sending location.hash to attacker-controlled destination, or XSS/DOM sink on handoff.
Verify steps
(post-auth) complete recovery/invite flow while monitoring for requests carrying the hash token, external network calls, or DOM sinks reflecting hash content.
Impact
session-token theft -> full ATO (High)
Testability
AUTH_HELPED
model: bigpickle · auto-synced from leads/lead-*.md