{
  "id": 3979215,
  "title": "How I Found a postMessage Origin Bypass in an OAuth SDK",
  "url": "https://urgent.news/2026/08/28/how-i-found-a-postmessage-origin-bypass-in-an-oauth-sdk",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-28T14:33:30.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/thecrazyrabbit/how-i-found-a-postmessage-origin-bypass-in-an-oauth-sdk-3a8j"
  },
  "original_language": "en",
  "account": "A security researcher discovered a vulnerability in an OAuth SDK used by a web3 project. The issue arose from an OAuth popup that communicated with the main application window using the `postMessage` API. This communication lacked an origin check, allowing attackers to spoof messages from the legitimate OAuth popup. The SDK generated message IDs sequentially, making it easy for attackers to predict the next ID and send malicious messages. The researcher reported the issue, and the fix was as simple as adding an origin check to the message event listener. This story highlights the importance of validating `event.origin`, using unpredictable IDs, and maintaining consistency in security practices across codebases.",
  "summary": "I spend a lot of time reading other people's code. Not because I enjoy it—though honestly, I kind of do—but because that's where the interesting bugs live. Not the flashy ones that get all the attention on Twitter. The quiet ones. The ones hiding in plain sight, inside a single missing if statement. This is the story of one of those bugs. The Backstory A few weeks ago I was doing a security…",
  "key_points": [
    "Security researcher found postMessage bypass vulnerability in OAuth SDK",
    "Lack of origin check allowed attackers to spoof messages from OAuth popup",
    "Adding origin check to message event listener fixed the issue"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}