---
title: "Discussion on \"OAuth Non-Happy Path to ATO\" | Hashnode"
description: "Discussion on \"OAuth Non-Happy Path to ATO\". Learn how small errors in OAuth implementation can lead to significant security vulnerabilities like one-click account takeover in web applications"
url: "https://hashnode.com/posts/oauth-non-happy-path-to-ato/67420e9294e2bf9e3883a715"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [OAuth Non-Happy Path to ATO](https://blog.voorivex.team/oauth-non-happy-path-to-ato?utm_source=hashnode&utm_medium=feed)

Learn how small errors in OAuth implementation can lead to significant security vulnerabilities like one-click account takeover in web applications

Nov 22, 2024 · 7 min read · blog.voorivex.team  
Read the article

-   [#bugbounty](https://hashnode.com/tag/bugbounty)
-   [#oauth](https://hashnode.com/tag/oauth)
-   [#account-takeover](https://hashnode.com/tag/account-takeover)

## Written by

[Omid Rezaei](https://hashnode.com/@omidrezaei)

@omidrezaei

  
[View profile](https://hashnode.com/@omidrezaei)

## Responses 4

Markdown supported · ⌘↵ to post

[Makbeyound](https://hashnode.com/@Makmom)

[May 25, 2025](https://hashnode.com/posts/oauth-non-happy-path-to-ato/67420e9294e2bf9e3883a715/comment/683351b20db3d4a61345af83)

Awesome

[Omid Tabei](https://hashnode.com/@theomidtabei)

[Jan 16, 2025](https://hashnode.com/posts/oauth-non-happy-path-to-ato/67420e9294e2bf9e3883a715/comment/6788d0d05ff60734c8c3c77b)

Great 💙💙💙

[Omid Tabei](https://hashnode.com/@theomidtabei)

[Jan 15, 2025](https://hashnode.com/posts/oauth-non-happy-path-to-ato/67420e9294e2bf9e3883a715/comment/6787eac5c23a25910fbcc2d9)

دەس خۆش

[Indexe](https://hashnode.com/@indexe)

[Dec 18, 2024](https://hashnode.com/posts/oauth-non-happy-path-to-ato/67420e9294e2bf9e3883a715/comment/67629e1fb2a9f8fcaaadf920)

Great article. I was wondering, why use window.open here? Can't you achieve the same behavior without it? Just curious if there’s a specific reason behind it.

[Omid Rezaei](https://hashnode.com/@omidrezaei)

[Dec 24, 2024](https://hashnode.com/posts/oauth-non-happy-path-to-ato/67420e9294e2bf9e3883a715/comment/67629e1fb2a9f8fcaaadf920#reply-676a7d7b5b16e250500c6457)

we need the attacker domain in the referer header in the last step so because of that here I use window.open to achieve that

[FrixRev](https://hashnode.com/@FrixRev)

[Nov 23, 2024](https://hashnode.com/posts/oauth-non-happy-path-to-ato/67420e9294e2bf9e3883a715/comment/67421f62dc5e1785bd73d2fa)

very good