OAuth's rough month: What five recent vulnerabilities say about token trust

Five bugs, four codebases, one recurring mistake: checking that a token is valid instead of checking that it’s valid for who it claims to be.