OAuth2.0 and OpenID from an information security perspective.
The OAuth 2.0 Authorization Framework (RFC 6749)
OAuth 2.0 Threat Model and Security Considerations (RFC 6819)
OAuth 2 Simplified
OAuth 2.0
Diagrams And Movies Of All The OAuth 2.0 Flows
Which OAuth 2.0 Flow Should I Use?
Publications about OAuth & OIDC by Daniel Fett
OpenID Connect
Understanding ID Token
Inclusion Relation among JWS, JWE, JWT, ID Token and Access Token
[pdf] OpenID Connect Security Considerations
OpenID Specifications
OAuth 2.0 Threat Model Pentesting Checklist
Hack3rScr0lls OAuth2.0 attacking mindmap
OAuth to Account takeover
OAuth 2.0 Vulnerabilities
OpenID Connect Vulnerabilities
OAuth by Sakurity
OAuth 2.0 Security Cheat Sheet (by Koen Buyens)
OAuth to Account takeover
OAuth 2.0 authentication vulnerabilities (PortSwigger)
Damn Vulnerable OAuth 2.0 Applications
HackTheBox Oouch machine (retired)
Spring Security OAuth2 Remote Command Execution Vulnerability (CVE-2016-4977)
PentesterLab Pro Exercises (filter by "OAuth")
Top OAuth reports from HackerOne
#317476 Account takeover in Periscope TV (Host header poisoning)
Bypassing GitHub's OAuth flow
Traveling with OAuth - Account Takeover on Booking.com
Multiple bugs chained to takeover Facebook Accounts which uses Gmail
[video] HackTheBox - Oouch (by IppSec)
Hacktivity'20 Notes Surfer task
[video] How to Hack OAuth by Aaron Parecki
Egor Homakov's OAuth blogposts
Common OAuth issue you can use to take over accounts
The Most Common OAuth2 Vulnerability
Hidden OAuth attack vectors
Account hijacking using "dirty dancing" in sign-in OAuth-flows
Salt Labs exposes a new vulnerability in popular OAuth framework Expo, used in hundreds of online services
Prevent Attacks and Redirect Users with OAuth 2.0 State Parameters
How to prevent OAuth authentication vulnerabilities
OAuth 2.0 Security Best Current Practice
API Security Checklist (OAuth)
Jwtear - A modular command-line tool to parse, create and manipulate JSON Web Token(JWT) tokens for security testing purposes.
OAUTH.TOOLS
Google OAuth 2.0 Playground
OAuth.com Playground
Attacking JWT authentication
Practical Approaches for Testing and Breaking JWT Authentication
reddit discussion about "Practical Approaches for Testing and Breaking JWT Authentication"
Books about OAuth 2.0 (by oauth.net)
Advanced API Security: OAuth 2.0 and Beyond (2nd edition)
API Security in Action
OAuth 2.0: Getting Started in Web-API Security