🎯 New Report #3734676: Taskcluster web-server OAuth2 authorization codes are reusable and the exchange handler checks the wrong expiry column
🔺Severity: Medium
👽 Reporter: anshuman bh
⭐️ Reputation: 3737
🛠 State: resolved
💼 Team: Mozilla
💵 Bounty: 2000
🕐 Submitted: 2026-05-14
⏰ Disclosed: 2026-06-23 12:37:52
📝 Summary: The Taskcluster web-server's OAuth2 token-exchange handler did not consume authorization codes and did not enforce the authorization-code expiry. A leaked authorization code could be replayed to mint additional bridge access tokens for the original user, past the 10-minute window required by the OAuth2 standard. The expiry check in the token-exchange handler and the bridge-token-to-credentials handler read the wrong expiry column, allowing expired codes to remain usable until the daily cleanup cron deleted them.
📂 Report JSON File: 3734676
@hackeronereports