Various third-party single sign-on (SSO) services~(e.g., Facebook Login and Twitter Login) are widely deployed by web applications. Security issues exist in integrating these services. In this work, we develop MOSCAN, a model-based scanner for detecting and reporting security vulnerabilities in SSO implementations. MOSCAN takes as input a state machine built based on an SSO standard and an empirical study to represent participants’ states and transitions during the login process. It analyzes network traces captured during the execution of SSO services. We evaluate MOSCAN with 23 real-world websites which integrate the Facebook SSO service to test its capability of identifying security vulnerabilities. It can find three known weaknesses and one new logic fault, showing a new perspective in testing stateful protocol implementations like SSO services. To show the adaptability of MOSCAN’s state machine, we also test other SSO service. Our demonstration is available at https://youtu.be/HI3S9IaUDGU. Our code is available at https://github.com/baigd/moscan.