OAuth+XSS Attack Threatens Millions of Web Users With Account Takeover

Salt Labs identified a critical attack chain that pairs OAuth implementation flaws with cross-site scripting (XSS) to steal authentication tokens and perform account takeover. The research demonstrated this against Hotjar (a service used by over one million sites) and Business Insider, highlighting the potential exposure of names, emails, messages, bank details, and credentials; both issues were reported and remediated, but researchers warn the combination is likely widespread.