OAuth Access Token Stolen via Redirect URI Abuse

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to steal OAuth access tokens by abusing redirect URIs. It specifically looks for HTTP requests containing both 'access_token=' and 'redirect_uri=' in the URI, which could indicate an attacker trying to capture a legitimate access token by redirecting it to a controlled URI.