Added references to exploitable OAuth2 feature