  OAuth is the new de facto standard for delegating authorization in the web.
An important limitation of OAuth is the fact that it was designed for
authorization and not for authentication. The usage of OAuth for authentication
thus leads to serious vulnerabilities as shown by Zhou et. al. in [44] and Chen
et. al. in [9]. OpenID Connect was created on top of OAuth to fill this gap by
providing federated identity management and user authentication. OpenID Connect
was standardized in February 2014, but leading companies like Google,
Microsoft, AOL and PayPal are already using it in their web applications [1],
[2], [3], [30].
  In this paper we describe the OpenID Connect protocol and provide the first
in-depth analysis of one of the key features of OpenID Connect: the Discovery
and the Dynamic Registration extensions.We present a new class of attacks on
OpenID Connect that belong to the category of second-order vulnerabilities.
These attacks consist of two phases: First, the injection payload is stored by
the legitimate application. Later on, this payload is used in a
security-critical operation. Our new class of attacks - called Malicious
Endpoints attacks - exploits the OpenID Connect extensions Discovery and
Dynamic Registration. These attacks break user authentication, compromise user
privacy, and enable Server Side Request Forgery (SSRF), client-side code
injection, and Denial-of-Service (DoS). As a result, the security of the OpenID
Connect protocol cannot be guaranteed when these extensions are enabled in
their present form.
  We contacted the authors of the OpenID Connect and OAuth specifications. They
acknowledged our Malicious Endpoint attacks and recognized the need to improve
the specification [29]. We are currently involved in the discussion regarding
the mitigation of the existing issues and an extension to the OAuth
specification.
