Missing OAuth State Parameter Enables Account Takeover Without Stealing Passwords

A flaw in OAuth's authorization code flow allows attackers to hijack victim accounts by exploiting the absence of the 'state' parameter, the only mechanism that links an OAuth callback to the session that started it. Without this parameter, an attacker can initiate an OAuth flow, pause before completion, and trick a victim into finishing it — silently binding the attacker's identity to the victim's account. RFC 6749 listed the state parameter as optional, and a 2016 study found 61% of OAuth-deploying sites skipped CSRF protections entirely, leaving most production deployments vulnerable. Real-world exploits include CVE-2019-10315, where a Jenkins GitHub Auth Plugin flaw let attackers gain admin privileges without ever learning the victim's password. RFC 9700, published in January 2025, finally mandates that clients use either the state parameter or PKCE for CSRF protection, though most existing libraries still follow the older, weaker RFC 6749 guidance.