Mini-Programs, Mega-Problems: Unveiling OAuth-based Authentication Misuses in Mini-Programs via Dynamic Analysis

Source: arXiv:2607.08232 · Published 2026-07-09 · By Zidong Zhang, Zhentao Xie, Lingyun Ying, Qinsheng Hou, Yacong Gu, Wenrui Diao et al.

TL;DR

This paper investigates security vulnerabilities arising from improper integration of OAuth-based Authentication (OBA) flows in mini-programs embedded within super apps such as WeChat and Baidu. Unlike traditional OAuth on web or mobile, mini-program OBA relies on platform-specific APIs tightly coupled with the host super app ecosystem. The authors identify three new types of runtime OBA misuses—credential leakage enabling client-side identity forgery, misuse of static identifiers like UnionID as standalone authentication tokens, and plaintext propagation of sensitive identifiers after authorization. These misuses lead to critical authentication bypass and identity impersonation risks.

To systematically detect these issues at scale, the authors design and implement MiniAuth, the first dynamic analysis framework for automated OBA misuse detection in mini-programs. MiniAuth combines static and dynamic analysis with UI automation and OCR to identify OBA login pages, trigger authentication flows, and monitor runtime behaviors. It handles obfuscated mini-programs which traditional static tools miss. Applying MiniAuth to over 46,000 mini-programs across WeChat and Baidu reveals 1,834 misuse cases including vulnerabilities in government and healthcare apps exposing sensitive personal data. The authors also discover a cryptographic design flaw in Baidu's OBA APIs enabling brute-force of session keys. They responsibly disclosed findings which received multiple official vulnerability IDs. The work highlights pervasive OBA misuse risks across ecosystems and calls for stronger developer guidance and platform protections.

Key findings

• MiniAuth analyzed 44,273 WeChat and 2,721 Baidu mini-programs (over 46,000 total).
• Identified 1,834 OBA misuse cases affecting 1,688 mini-programs; 619 had multiple vulnerabilities.
• M1 misuse (credential exposure to client) enables client-side forging of encrypted identity payloads, bypassing server verification.
• M2 misuse: treating static UnionID as standalone authentication tokens allows impersonation by replaying publicly obtainable identifiers.
• M3 misuse: transmitting sensitive identifiers like phone numbers in plaintext after authorization allows attackers to modify requests and bypass auth checks.
• Found cryptographic design flaw in Baidu OBA API where the initialization vector (IV) partially leaks session key, enabling brute force attacks.
• MiniAuth uses OCR-based UI exploration to identify OBA login pages under heavy obfuscation, a major limitation for static approaches.
• Cross-platform evaluation shows OBA misuses are widespread beyond WeChat and Baidu, seen also in Alipay and TikTok mini-programs.

Threat model

The adversary is an active attacker controlling an independent device launching mini-programs via official super apps (e.g., WeChat, Baidu). They can sniff and modify network traffic (MITM proxy), unpack and analyze mini-program code, and obtain public user identifiers (UnionID). They cannot access or compromise the victim’s device or the underlying OS or super app sandbox. The attacker exploits logical flaws in third-party developer OBA implementations to impersonate victims or extract sensitive data.

Methodology — deep read

1. Threat Model & Assumptions: The adversary accesses mini-programs via official super apps (WeChat, Baidu) on standard platforms (iOS, Android, Windows). They do not compromise victim devices but can sniff and manipulate network traffic on their own devices (e.g., via MITM proxy). They may unpack and decompile mini-program sources and gather metadata and public IDs like UnionID to mount impersonation attacks. The super app sandbox and OS are considered trusted; the focus is on developer logic flaws in OBA integration.

2. Data: The authors collect 44,273 WeChat and 2,721 Baidu mini-programs. They filter mini-programs using OBA by crawling privacy declarations specifying collection of sensitive info (e.g., phone numbers). The datasets include obfuscated and non-obfuscated mini-programs, covering a wide real-world sample. Preprocessing includes unpacking packages and extracting configuration files.

3. Architecture/Algorithm: MiniAuth consists of three components: Pre-filter, Login Page Identifier, and Dynamic Analyzer. The Pre-filter uses privacy declaration pattern matching to identify OBA-enabled apps. The Login Page Identifier uses static code analysis to pinpoint OBA login pages in non-obfuscated apps, tracing platform-specific function calls like wx.login and tying them to UI elements via event bindings. For obfuscated apps, MiniAuth employs a DFS UI traversal triggered by OCR keyword recognition of platform authorization popups to dynamically find the OBA login entry points. The Dynamic Analyzer automates interacting with the mini-program executing the OBA flow by hooking the super app process (using an Xposed plugin) allowing launching specific pages via Intents/deeplinks and simulating user interactions. It monitors network traffic to detect runtime exposures like session_key leaks and plaintext identifiers.

4. Training Regime: N/A (not a ML paper).

5. Evaluation Protocol: MiniAuth is evaluated on the collected samples, measuring detection efficacy for three OBA misuse classes (M1, M2, M3). The system is validated to work across obfuscated and non-obfuscated code. Findings include detailed exploitation proof-of-concepts and real-world examples like the BDZR Museum mini-program. Cross-platform validation is done on other mini-program ecosystems (Alipay, TikTok). Vulnerabilities were responsibly disclosed and assigned official vulnerability IDs (CNVD/CNNVD).

6. Reproducibility: The paper does not mention public release of MiniAuth code or datasets explicitly, so reproducibility may be limited due to proprietary mini-program packaging and super app platform restrictions.

Concrete end-to-end example: For an obfuscated WeChat mini-program, MiniAuth extracts the app.json config file to list pages, uses OCR-assisted DFS traversal to find the page triggering the OBA authorization popup, then hooks the super app process to launch that mini-program login page automatically. It simulates user tap actions to invoke wx.login, intercepts HTTP requests to the developer’s backend, and observes whether session_key or encryptedData is improperly exposed client-side or transmitted insecurely. This dynamic interrogation allows MiniAuth to detect runtime logic flaws such as credential leakage unseen by static analysis.

Technical innovations

• Identification and systematization of three new runtime OBA misuse patterns in mini-program authentication, distinct from previous static-code findings.
• Design of MiniAuth, the first dynamic analysis framework specialized for large-scale detection of mini-program OBA misuses, supporting both obfuscated and non-obfuscated apps using combined static and dynamic methods.
• Novel OCR-assisted UI traversal algorithm for automatic identification of OBA login pages under heavy code obfuscation by detecting platform authorization pop-ups.
• External automation framework hooking into super app process to launch mini-programs and drive interactions via crafted Intents/deeplinks, overcoming sandbox restrictions without source instrumentation.

Datasets

• WeChat mini-programs — 44,273 — Crawled public mini-program dataset with privacy declarations and app.json metadata.
• Baidu mini-programs — 2,721 — Crawled public mini-program dataset similarly filtered.

Baselines vs proposed

• Static code analysis baseline: unable to detect runtime misuses in obfuscated mini-programs, leading to false negatives that MiniAuth detects dynamically.
• Manual auditing baseline: unscalable, whereas MiniAuth automates discovery at scale (46k+ programs).
• Cross-platform: Misuses consistently occur across WeChat, Baidu, Alipay, TikTok mini-programs, showing prior isolated platform-centric approaches insufficient.

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.08232.

Fig 2: The OBA process in WeChat mini-programs. Other mini-programs follow similar steps.

Fig 3: Misuses and attack process of the BDZR Museum

Fig 1: WeChat mini-program architecture.

Fig 4: The code snippet of the OBA process from the BDZR

Fig 5: The workflow of MiniAuth.

Fig 6: An example of how to trigger the OBA process in

Fig 7 (page 8).

Fig 8 (page 8).

Limitations

• MiniAuth’s dynamic approach relies on automating UI traversals which may miss deeply nested or highly dynamic OBA entry points.
• No mention of evaluating resilience against adversarial evasion techniques specifically crafted to hide misuse during dynamic analysis.
• The framework targets logic flaws in OBA integration, assuming trusted super app sandboxes; it does not address device compromise or native OS-level threats.
• Reproducibility is limited due to lack of public dataset/code release and reliance on proprietary super app environments.
• The scope excludes behavioral or runtime adversarial attacks beyond misuse detection, such as advanced session hijacking or social engineering.

Open questions / follow-ons

• How might adversaries actively evade dynamic analysis frameworks like MiniAuth by modifying runtime behaviors or detecting analysis environments?
• Can platform-level defenses be designed to automatically validate session_key and sensitive data handling without relying on developer implementation?
• What mechanisms can enforce cryptographic best practices in mini-program OBA APIs to prevent design flaws like the Baidu IV reuse issue?
• How does the severity and exploitability of OBA misuses vary across different mini-program categories (e.g., finance vs entertainment vs government)?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, this work highlights that authentication misuse in mini-programs can facilitate victim impersonation and session hijacking without typical vulnerabilities like credential leaks or client device compromise. Since these misuses exploit logical flaws in OAuth-style integrations specific to super app ecosystems, defenders should consider integrating dynamic behavioral analysis tools that observe real-world authentication flows rather than relying solely on static scanning or syntactic validation.

Moreover, the detected vulnerabilities demonstrate how insecure OBA handling can expose sensitive user identifiers and session secrets that could be leveraged by automated bot attacks or account takeover campaigns. This underlines the necessity for layered defenses including runtime monitoring, anomaly detection in authentication workflows, and constructive developer guidance to strengthen trust boundaries. The cross-platform nature of misuses also suggests bot-defense architectures should encompass ecosystem-specific OAuth adaptations rather than standard web/mobile OAuth assumptions.

Cite

@article{arxiv2607_08232,
  title={ Mini-Programs, Mega-Problems: Unveiling OAuth-based Authentication Misuses in Mini-Programs via Dynamic Analysis },
  author={ Zidong Zhang and Zhentao Xie and Lingyun Ying and Qinsheng Hou and Yacong Gu and Wenrui Diao and Jianliang Wu },
  journal={arXiv preprint arXiv:2607.08232},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.08232}
}

Read the full paper

• arXiv:2607.08232 (abstract)
• arXiv:2607.08232 (PDF)