The advisory is up at http://oauth.net/advisories/2009-1 http://oauth.net/advisories/2009-1 and the blogs are abuzz with more (or, in enough cases, less) inform

The advisory is up at http://oauth.net/advisories/2009-1 http://oauth.net/advisories/2009-1 and the blogs are abuzz with more (or, in enough cases, less) information. Basically, the problem is that an attacker can keep a request token around and have the victim complete the authentication with the old request token, thus gaining authorization in the victim's name. There is no way for the consumer to tell what's going on, currently. The suggested workarounds are monitoring and a strong statement about starting Auth workflows from untrusted places. But we all know how well those work. I'm curious about OAuth 1.1 or whatever.