Booking.com account takeover flaw shows possible pitfalls in OAuth implementations.

The article reports that Booking.com, one of the world's largest online travel agencies, has patched a vulnerability in its implementation of the OAuth protocol that could have allowed attackers to gain access to customer accounts by simply tricking them into clicking a link. It mentions attacker could have taken over accounts of users logging in via Facebook. It also mentions security breach in OAuth can lead to identity theft, financial fraud, and access to all sorts of personal information.