Nice finds! Great explanations too. Have you ever used Autorize BApp in Burpsuite? It's great for this sort of thing.

I haven't used "Auth Analyzer" yet but it's another good framework in Burpsuite for testing this sort of thing!

Cheers!