Topic starter
02/08/2026 12:17 pm
TL;DR: A DOM-based XSS flaw can be chained with OAuth login flows to bypass HTTP-only cookies and extract account tokens, creating account takeover risk even in environments with strong web hardening, according to Salt’s research. The lesson is that application security controls must account for cross-component trust paths, not just single-vulnerability fixes.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “Over 1 Million websites are at risk of sensitive information leakage — XSS is dead. Long live XSS”.
Key questions
Q: What breaks when XSS can reach an OAuth login flow?
A: The main failure is that browser script execution can move from a content issue to an identity issue.
Q: Why do HTTP-only cookies not stop modern XSS account takeover?
A: HTTP-only blocks JavaScript from reading cookie values, but it does not protect credentials exposed somewhere else in the authentication journey.
Q: How do security teams spot OAuth flows that are unsafe under XSS?
A: Look for redirects, fragments, and same-origin windows that expose authentication material to browser script.
Practitioner guidance
- Harden client-side input handling Audit every browser-facing parameter for unsafe sinks such as redirects, HTML injection, and script execution paths.
- Review OAuth return flows end to end Map every authorization code, token, and fragment handoff in your login journey and confirm that none of them become browser-readable to same-origin script.
- Treat HTTP-only as a partial control Keep HTTP-only cookies enabled, but do not assume they prevent account takeover when other credentials can surface in the browser.
Bottom line: The article shows that XSS remains dangerous when it can observe or influence OAuth handoffs, even in sites that already use common web hardening measures.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:19 pm
XSS has not gone away, but its modern risk is identity chaining. The vulnerability is no longer just script execution in isolation. When browser code can observe authentication redirects, the control failure becomes one of identity flow governance, not only input validation. Application security teams need to treat redirect paths, fragments, and window relationships as part of the trust boundary.
A question worth separating out:
Q: What should teams do when browser script can reach authentication state?
A: Treat the login journey as one attack surface and tighten the places where identity material appears. Validate redirect targets, remove unnecessary browser-readable credential exposure, and test whether injected code can follow or reuse the handoff before it reaches account completion.
👉 Read our full editorial: XSS and OAuth combine into a modern account takeover path