OAuth Flaw Exposed Millions of Airline Users to Account Takeovers

Researchers at Salt Security discovered a critical OAuth implementation flaw in a major travel services provider that could redirect users' authorization credentials to attacker-controlled servers, enabling full account takeover of airline-linked accounts and access to personal and rewards data; the vendor has since fixed the issue. The report emphasizes the systemic risk of insecure third-party integrations, cites prior similar findings (e.g., Booking.com, Grammarly), and notes that attacks would appear indistinguishable from legitimate requests to affected airlines.