Other nomination
Bypassing 2FA using OpenID Misconfiguration
An OpenID relying party asks for authentication methods through the acr_values parameter, and the identity provider honours any method the client has enabled. Changing the request from one-time password to SMS let an attacker satisfy two-factor authentication with a throwaway SMS number, skipping the authenticator app step entirely.
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.