Covert Redirect isn’t a vulnerability, and it’s nothing like Heartbleed

OAuth 2.0 and OpenID enable a visitor to a given domain, to gain access by using their existing credentials on another website, such as Facebook, Microsoft, or LinkedIn. The root cause of the problem is a lack of token whitelisting in the framework, says CloudLock’s Kevin OBrien. This isn’t the first time the issue has been raised, and it isn’t anywhere near as bad as Heartbleed was. Most of the websites using OAuth. are social in nature, so the problem isn’t as big as it seems.”]

Source: https://www.csoonline.com/article/2150983/covert-redirect-isnt-a-vulnerability-and-its-nothing-like-heartbleed.html