FlagThis

Abstract

Mini-programs have become a dominant paradigm for lightweight application deployment within super apps such as WeChat. To support seamless integration, super apps provide platform-specific OAuth-based Authentication (OBA) mechanisms for user login. However, improper integration of OBA flows by third-party developers can lead to critical security flaws. In this paper, we systematize three runtime OBA misuse patterns that arise in mini-program implementations and enable attackers to impersonate victims. To assess their real-world impact, we design and implement MiniAuth, the first analysis framework to systematically analyze mini-program OBA misuse at scale. MiniAuth automatically pinpoints the OBA login page of a mini-program, executes the workflow dynamically, and analyzes its runtime behaviors. This enables it to handle obfuscated mini-programs and uncover vulnerabilities within dynamic behaviors that existing approaches cannot detect. Applying MiniAuth to 44,273 WeChat and 2,721 Baidu miniprograms, we uncover 1,834 misuse cases, including critical logic flaws that enable client-side identity forgery via exposed credentials and authentication bypass through static or plaintext identifiers. Our cross-platform evaluation further shows that such misuses are not confined to a single ecosystem but consistently appear across Both authors contributed equally to this research. Corresponding authors. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org. _Anonymous Submission to ACM CCS, 2026_ 2026 ACM. ACM ISBN 978-x-xxxx-xxxx-x/YYYY/MM `https://doi.org/10.1145/nnnnnnn.nnnnnnn` different mini-program platforms. We also identify a cryptographic design flaw in Baidus OBA APIs that allows brute-forcing of session keys. We responsibly disclosed our findings to the developers and platforms, receiving acknowledgments and assigned CNVD/CNNVD IDs. These results underscore the need for more robust developer guidance and enhanced platform-level safeguards.