FlawedToken

A purpose-built vulnerable OAuth 2.0 environment for security researchers, red teamers, and anyone learning auth attack techniques.

FlawedToken is intentionally broken. Every misconfiguration is deliberate, documented, and toggleable. Use it to practice OAuth attack flows in a safe, controlled environment before running them against authorized targets.

Why it exists

Every red team engagement that touches an identity provider has the same arc: the client is confident, and then you find the authorization server accepting response_type=token on a code-only flow, or a SAML assertion that replays cleanly. None of that is exotic. The gap has never been knowledge — it's beenproof.

FlawedToken closes that gap. One command and you have a running authorization server and client app with the misconfigurations active by default, plus toggles to switch to correct behavior so you can see exactly what changes.

What's inside

• A vulnerable OAuth 2.0 authorization server
• A client application with deliberately broken flows
• Documented flaws — each with its own writeup
• Docker Compose setup: docker compose up

The flaw documentation

Each flaw has a dedicated writeup that mirrors the research posts on this site:

• Flaw 01 — Authorization code interception
• Flaw 02 — Redirect URI manipulation

Run it

git clone https://github.com/tstacy/flawedtoken.git
cd flawedtoken
docker compose up

No cloud accounts required. No authorized-target paperwork for a lab you control.