Case 5 — OAuth Device Authorization Grant

The reporter claims one-click ATO.

Step 1 — mint (no auth):

POST /oauth/dag/device/code
Content-Type: application/x-www-form-urlencoded

client_id=attacker-controlled-client

Step 2 — victim approves: open the verification_uri from the response and click Approve (this is the VICTIM's action).
Step 3 — exchange for a token:

POST /oauth/dag/device/token
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=<device_code>

With the token: GET /api/v4/map-rank-tracker/v0/campaigns and Authorization: Bearer <token>.

Triage questions: what MUST the victim do for the chain to close? Does the attack exist without their "Approve"? Is this ATO or consent phishing / social engineering — do we accept that?

H1 Triage Range - training mock. All data, keys and emails are fictional. Fetch and external APIs are simulated. ← home