Random account takeover via misconfigured OAuth
Introduction: