MartinMystikJonas
commented
9 months ago FAcebook, Google etc. would return resource owner data even for token generated for another app. So atacker can use token generated for logging user to his app to login to user account on another apps that does not explicitly validate that token is generated for them.
I just stumbled upon this article about possible security issue in OAuth2 implementations: https://salt.security/blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts
It seems to me this implementation is also vulberable to this attack.