The OAuth community is committed to identifying and addressing any security issues raised related to the OAuth protocol and extensions. Any identified threat will be publish on this page as soon as it is safe to do so. Due to the nature of many security threats, they cannot be disclosed before sufficient notice it given to vulnerable parties.
The following are the security threats known and the protocol version they affect:
OAuth Core 1.0
How to Report Security Threats?
Please report any concerns to the OAuth mailing list. Please DO NOT discuss unknown security threats in public as they are likely to be used by attacker before a solution can be applied.