Null byte in token endpoint parameters (code / client_id) triggers HTTP 500 instead of OAuth error response
Author: Allen-wickCreated Jun 11, 2026Updated Jun 11, 2026
Summary
Sending an OAuth token request where the code or client_id form parameter contains a null byte (%00) causes SimpleLogin's token endpoint to return HTTP 500 (its generic "Server error" HTML page) instead of the RFC 6749 §5.2 error response (HTTP 400 with a JSON {"error": "..."} body).
Affected Endpoint
POST /oauth2/token
Steps to Reproduce
# Null byte in code → HTTP 500
curl -i -X POST 'http://localhost:7777/oauth2/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=authorization_code&code=test%00code&client_id=fuzz-client&client_secret=secret'
# Null byte in client_id → HTTP 500
curl -i -X POST 'http://localhost:7777/oauth2/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=authorization_code&code=test&client_id=fuzz-client%00evil&client_secret=secret'Actual response (both):
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=utf-8
<html>... "Server error — Looks like we are having some server issues..." ...</html>Expected response (RFC 6749 §5.2):
HTTP/1.1 400 Bad Request
Content-Type: application/json
{"error": "invalid_request"}Source: simple-login/app