OAuth Flow CSRF: How a Missing State Parameter Enables Forced Authorization

The OAuth flow has four participants: client, authorization server, resource server, and, when state...