Dynamic Analysis Uncovers Three New OAuth Authentication Misuses in Super-App Mini-Programs

arXiv·medium signal

Mini-programs inside super apps like WeChat rely on OAuth for login, but improper third-party integration creates critical flaws. Using dynamic analysis, the authors discover three new runtime OAuth-based-authentication misuse types — distinct from prior static-code studies — that let attackers impersonate victims. A reminder that runtime OAuth flows, not just source code, are a live attack surface for embedded app platforms.