{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,30]],"date-time":"2026-09-30T20:01:22Z","timestamp":1790798482312,"version":"4.1.0"},"reference-count":67,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5]]},"DOI":"10.1109\/sp63933.2026.00128","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"4517-4536","source":"Crossref","is-referenced-by-count":0,"title":["Demystifying the (In)Security of Oauth-Based Account Linking in Connector Ecosystems"],"prefix":"10.1109","author":[{"given":"Kaixuan","family":"Luo","sequence":"first","affiliation":[{"name":"The Chinese University of Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xianbo","family":"Wang","sequence":"additional","affiliation":[{"name":"The Chinese University of Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Pui Ho Adonis","family":"Fung","sequence":"additional","affiliation":[{"name":"Samsung Research America"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wing Cheong","family":"Lau","sequence":"additional","affiliation":[{"name":"The Chinese University of Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","first-page":"3221","article-title":"Universal cross-app attacks: Exploiting and securing OAuth 2.0 in integration platforms","volume-title":"34th USENIX Security Symposium (USENIX Security 25)","author":"Luo"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.17487\/rfc6749"},{"key":"ref3","article-title":"OAuth 2.0 authorization URL session binding - Amazon Bedrock AgentCore","volume-title":"AWS Documentation"},{"key":"ref4","article-title":"About Credential Manager in Azure API Management","volume-title":"Microsoft Learn"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978385"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2017.20"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2019.00036"},{"key":"ref8","first-page":"2459","article-title":"Cerberus: Query-driven scalable vulnerability detection in OAuth service provider implementations","volume-title":"Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.17487\/rfc8252"},{"key":"ref10","journal-title":"CWE-384: Session fixation"},{"key":"ref11","article-title":"Session fixation vulnerability in web-based applications","volume-title":"ACROS Security","author":"Kolsek","year":"2002"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/1982185.1982511"},{"key":"ref13","article-title":"CWE-441: Unintended proxy or intermediary (\u2019confused deputy\u2019)","journal-title":"CWE - Common Weakness Enumeration"},{"key":"ref14","article-title":"$\\mathrm{n} 8 \\mathrm{n}-\\text{io} \/ \\mathrm{n} 8 \\mathrm{n}$","volume-title":"fix(core): Improve the security on oauth callback endpoints"},{"key":"ref15","volume-title":"Artifacts"},{"key":"ref16","article-title":"Updates to OAuth 2.0 Security Best Current Practice","volume-title":"Internet Engineering Task Force","author":"W\u00fcrtele","year":"2026"},{"key":"ref17","article-title":"OAuth 2.0 Threat Model and Security Considerations","author":"Lodderstedt","year":"2013","journal-title":"RFC 6819"},{"key":"ref18","article-title":"What is application integration?","volume-title":"IBM"},{"key":"ref19","volume-title":"What is application integration? - app integration explained"},{"key":"ref20","volume-title":"What is agentic ai? - agentic ai explained"},{"key":"ref21","article-title":"Same-origin policy - security","volume-title":"MDN Web Docs"},{"key":"ref22","volume-title":"eTLD - glossary"},{"key":"ref23","article-title":"Getting your API key","volume-title":"Arcade Docs"},{"key":"ref24","article-title":"Get workload access token - Amazon Bedrock AgentCore","volume-title":"AWS Documentation"},{"key":"ref25","article-title":"Identity management for agentic AI: The new frontier of authorization, authentication, and security for an AI agent world","author":"South","year":"2025","journal-title":"arXiv preprint"},{"key":"ref26","article-title":"Set-Cookie header - HTTP","volume-title":"MDN Web Docs"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2010.27"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.17487\/rfc9700"},{"key":"ref29","article-title":"Protect against consent phishing - Microsoft Entra ID","volume-title":"Microsoft Learn"},{"key":"ref30","article-title":"Cross-Device Flows: Security Best Current Practice","author":"Kasselman","year":"2025","journal-title":"Internet Engineering Task Force, InternetDraft draft-ietf-oauth-cross-device-security-12"},{"key":"ref31","article-title":"Proof Key for Code Exchange by OAuth Public Clients","author":"Sakimura","year":"2015","journal-title":"RFC 7636"},{"key":"ref32","article-title":"CWE-601: URL redirection to untrusted site (\u2019open redirect\u2019)","journal-title":"CWE - Common Weakness Enumeration"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3627106.3627140"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560692"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329801"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3545948.3545955"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP60621.2024.00016"},{"key":"ref38","first-page":"468","article-title":"AndroZoo: Collecting millions of Android apps for the research community","volume-title":"2016 IEEE\/ACM 13th Working Conference on Mining Software Repositories (MSR)","author":"Allix"},{"key":"ref39","article-title":"Dex to Java decompiler","volume-title":"skylot\/jadx"},{"key":"ref40","article-title":"A reverse engineering tool for decompiling and disassembling the React Native Hermes bytecode","volume-title":"P1sec\/hermes-dec"},{"key":"ref41","article-title":"Intent","volume-title":"Android Developers"},{"key":"ref42","article-title":"Chooser - developers - Dropbox","volume-title":"Dropbox Developers Documentation"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP60621.2024.00018"},{"key":"ref44","article-title":"OpenID Connect Core 1.0 incorporating errata set 2","volume-title":"The OpenID Foundation, Specification","author":"Sakimura","year":"2023"},{"key":"ref45","article-title":"About deep links I App architecture","volume-title":"Android Developers"},{"key":"ref46","first-page":"389","article-title":"AndroZoo: A retrospective with a glimpse into the future","volume-title":"Proceedings of the 21st International Conference on Mining Software Repositories","author":"Alecci"},{"key":"ref47","article-title":"Phishing attack vulnerability","volume-title":"Azure\/azure-tokens"},{"key":"ref48","article-title":"Secure auth in production","volume-title":"Arcade Docs"},{"key":"ref49","article-title":"Specification - Model Context Protocol","journal-title":"Anthropic"},{"key":"ref50","journal-title":"Authorization - Model Context Protocol"},{"key":"ref51","volume-title":"SEP-1036: URL mode elicitation for secure out-of-band interactions","author":"Barbettini"},{"key":"ref52","article-title":"Elicitation - Model Context Protocol","journal-title":"Anthropic"},{"key":"ref53","article-title":"Lab: Forced OAuth profile linking","volume-title":"Web Security Academy"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00024"},{"key":"ref55","first-page":"5539","article-title":"Cookie crumbles: breaking and fixing web session integrity","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Squarcina"},{"key":"ref56","article-title":"Origin cookies: Session integrity for web applications","author":"Bortz","year":"2011","journal-title":"Web 2.0 Security and Privacy (W2SP)"},{"key":"ref57","volume-title":"Hijacking OAUTH flows via cookie tossing","author":"Labs"},{"key":"ref58","article-title":"Zoom session takeover - cookie tossing payloads, OAuth dirty dancing, browser permissions hijacking, and WAF abuse","volume-title":"Harel Security Research"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.17487\/rfc9700"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/2897845.2897874"},{"key":"ref61","article-title":"OAuth security advisory: 2009.1","journal-title":"OAuth Community Site"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.17487\/rfc8628"},{"key":"ref63","volume-title":"Cross-device session fixation and how the DC API solves it","author":"Fett"},{"key":"ref64","article-title":"OpenID for Verifiable Presentations 1.0","volume-title":"The OpenID Foundation, Specification","author":"Terbu","year":"2025"},{"key":"ref65","article-title":"OAuth 2.0 for Browser-Based Applications","author":"Parecki","year":"2025","journal-title":"Internet Engineering Task Force, Internet-Draft draft-ietf-oauth-browser-based-apps-25"},{"key":"ref66","volume-title":"How Arcade proactively addressed the first major identity vulnerability in agentic AI","author":"Barbettini"},{"key":"ref67","article-title":"Updates to OAuth 2.0 Security Best Current Practice","volume-title":"IETF 125","year":"2026"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573408.pdf?arnumber=11573408","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,30]],"date-time":"2026-09-30T19:32:35Z","timestamp":1790796755000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573408\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5]]},"references-count":67,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00128","relation":{},"subject":[],"published":{"date-parts":[[2026,5]]}}}