OAuth Consent Screen Scope Injection

[roshankumar0036singh]

Problem Statement

A malicious OAuth client could attempt to alter the requested scopes between the initial authorization request and the user's consent submission if the state is not cryptographically bound.

Technical Approach

Ensure that the consent submission validates the original requested scopes temporarily stored in Redis against a cryptographically secure consent_challenge token.

Acceptance Criteria

• Users cannot grant scopes that were not explicitly requested in the initial /authorize step.
• The consent flow strictly honors the initial request parameters.

[TharunvenkateshN]

Hi @roshankumar0036singh,

I'd like to work on this issue.

Proposed Approach

1. Investigate Current Consent Flow

• Review the OAuth authorization and consent screen implementation.
• Identify how requested scopes are validated and persisted.

2. Reproduce the Vulnerability

• Verify whether unapproved or manipulated scopes can be injected during the authorization process.
• Analyze edge cases involving URL parameter tampering and modified requests.

3. Implement Scope Validation

• Enforce strict validation against:

  • Registered client scopes
  • Allowed server scopes
  • User-approved scopes

• Reject unauthorized or unexpected scope requests.

4. Security Hardening

• Prevent privilege escalation through scope manipulation.
• Ensure only validated scopes are included in authorization codes and issued tokens.

5. Testing

• Add security-focused tests covering:

  • Valid scope requests
  • Injected scopes
  • Modified authorization requests
  • Unauthorized privilege escalation attempts

6. Documentation

• Document validation rules and security considerations.

Expected Outcome

The OAuth authorization flow will prevent scope injection attacks and ensure tokens only contain explicitly authorized permissions.

Please assign this issue to me if the implementation plan aligns with project expectations.

[Itsssaksham]

can you assign this issue to me ?

[arcgod-design]

Hi @roshankumar0036singh! I'd love to work on this as part of SSoC '26.

My Approach:

• Strictly validate and whitelist allowed OAuth scopes on the server side, rejecting any scope not pre-registered for the client application
• Sanitize the scope parameter in the consent screen by comparing requested scopes against the application's registered scope list before displaying or granting them
• Return a proper OAuth error (invalid_scope) with a descriptive message for any disallowed or injected scopes
• Add integration tests covering scope injection attack vectors (e.g., extra scopes, scope escalation attempts)

Could you please assign this to me (@arcgod-design)? Thank you!