1. MALICIOUS LINK 2. AUTH REQ 3. REDIRECT TO IDP 4. OAUTH REQ 5. CODE REDIRECT 6. LEAK AUTH CODE ATTACKER OAUTH PROVIDER USER BROWSER VULNERABLE APP