Try to change the email of an account and check how the confirmation works. If weak, try to change the email to the victim one and confirm it.
If target allows you to reuse the reset link then hunt for more reset link via
- 1.Signup using the victims email in the platform and set a password (try to confirm if possible, but lacking access to the victim emails might be impossible)
- 2.Wait till the victim signs up using oauth and confirms the account
- 3.Hopefully, the regular signup will be confirmed and you will be able to enter in the victims account
If the page contains CORS missconfigurations you might be able to steal sensitive information from the user to takeover his account or make him change auth information for the same purpose:
If the page is vulnerable to CSRF you might be able to make the user modify his password, email or authentication so you can then access it:
If you find a XSS in application you might be able to stal cookies, local storage, or info from the web page that could allow you takeover the account:
If you find a limited XSS or a subdomain take over, you could play with the cookies (fixating them for example) to try to compromise the victim account:
If the authentication response could be reduced to a simple boolean just try to change false to true and see if you get any access.