About this episode

In this episode, the hosts discuss the changes from OAuth 2.0 to 2.1 and how hackers can exploit these changes.

Episode 169: In this episode of Critical Thinking - Bug Bounty Podcast gr3pme goes over some of the changes from OAuth 2.0 vs 2.1 and how Hackers can capitalize. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X:  https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/   ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord ! We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc. You can also find some hacker swag at https://ctbb.show/merch ! Today's Sponsor: Check out ThreatLocker Ringfencing https://www.criticalthinkingpodcast.io/tl-rf ====== This Week in Bug Bounty ====== Intigriti is providing free Burp Pro for Hackers! https://www.intigriti.com/blog/news/intigriti-collaborates-with-portswigger-to-support-ethical-hacking-excellence ======…

People in this episode

Hosts: Justin Gardner, Joseph Thacker, Brandyn Murtagh

Guest: gr3pme

Topics covered

• OAuth 2.1
• bug bounty
• ethical hacking
• security vulnerabilities
• account takeover
• PKCE Bypass

Keywords

• OAuth
• bug bounty
• security
• vulnerabilities
• ethical hacking
• account takeover
• PKCE

Sponsors

ThreatLocker

Mentioned in this episode

Organizations: Intigriti, Cloudflare, ZeroPath, Django-allauth, PortsWigger, Critical Research Lab

Books & works: OAuth 2.0, OAuth 2.1

More episodes of Critical Thinking - Bug Bounty Podcast

• Episode 171: Path-Scoped Cookie Hacks with Uppercase & Post-based Raw Protobuf XSS · April 23, 2026 · 23 min
• Episode 170: Claude Code + Tmux, Websockets, and Other Korea LHE Takeaways · April 16, 2026 · 33 min
• Episode 168: XSSDoctor - Client-side Path Traversal Research · April 2, 2026 · 1h 36m
• Episode 167: Stealing Bugs with Valeriy Shevchenko · March 26, 2026 · 52 min
• Episode 166: Rez0’s Top Claude Skill Secrets · March 19, 2026 · 53 min
• Episode 165: Protobuf Hacking, AI-Powered Bug Hunting, and Self-Improving Claude Workflows · March 12, 2026 · 44 min

Explore listener stats, chart rankings, contacts and more on the Critical Thinking - Bug Bounty Podcast podcast page.