GitHub.dev flaw lets attackers steal OAuth tokens in one click

2026-06-04

Researcher Ammar Askar demonstrated that a malicious GitHub.dev link with a booby-trapped Jupyter notebook can silently exfiltrate OAuth tokens, bypass trust prompts, enumerate private repositories, and exploit the absence of CSRF tokens.