Security issue

[MartinMystikJonas]

I just stumbled upon this article about possible security issue in OAuth2 implementations: https://salt.security/blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts

It seems to me this implementation is also vulberable to this attack.

[MartinMystikJonas]

FAcebook, Google etc. would return resource owner data even for token generated for another app. So atacker can use token generated for logging user to his app to login to user account on another apps that does not explicitly validate that token is generated for them.