Most OAuth sign-in breaches happen at the redirect, not in the token. Prefix matching, a missing state check, no PKCE and open redirects, each with a test.
When someone signs in to your app with an OAuth provider, the browser leaves for the provider and comes back to your redirect address carrying a one-time code. Nearly every serious attack on that exchange targets the trip back: the code is sent to the wrong place, accepted from the wrong person, or read by someone who should not see it. The fixes are small and well documented in RFC 9700, the current security guidance for OAuth. This guide walks through the mistakes that still turn up in login code and gives each one a quick test.
Read the full report on AISkills402: https://aiskills402.com/blog/oauth-redirect-flow-mistakes?utm_source=devto&utm_medium=social
