https://gauravnarwani.com/misconfigured-oauth-to-account-takeover/