Is Your OAuth Middleware Vulnerable? Evaluating Open-Source Identity Providers’ Security

The OAuth 2.0 protocol is a widely adopted standard for online authorization. Given its widespread use, it has received substantial attention from the research community towards assessing its security. Earlier research has primarily focused on the security of the protocol itself, or the implementation quality of popular online OAuth-based services. However, despite the numerous flaws that have been discovered in public OAuth services, there has only been limited research that directly studied the underlying OAuth middleware. In this study, we address this gap by conducting a systematic evaluation of eight popular open-source identity providers. In our analysis, we identified ten important types of security flaws among these providers. We further explore the root causes of these problems and discuss why certain parts of the OAuth standard are poorly implemented. Our findings reveal an alarming reality: we uncovered security weaknesses and vulnerabilities in seven out of eight examined middle-wares, with an average of three security issues per provider. While these weaknesses have been addressed, resulting in two CVEs, our results emphasize the importance of continued research efforts to improve the security of OAuth implementations.