The Current Landscape of OAuth Attacks

OAuth attacks exploit the authorization layer after user authentication, targeting access and refresh tokens that grant scoped, durable access to user data. Unlike traditional credential phishing, OAuth-based phishing bypasses MFA and password resets because tokens remain valid until explicitly revoked. The analysis highlights three core vulnerabilities: Cross-User OAuth Session Fixation (COSF), where attackers fixate OAuth sessions to hijack tokens; Cross-Tenant Client ID Confusion, where malicious tenants impersonate trusted apps within shared token vaults; and Cross-Connector OAuth Account Takeover, where attackers reroute authorization flows to gain full account control. These vulnerabilities are exacerbated by long-lived tokens and decentralized OAuth security, with smaller identity providers often lacking robust defenses. Defenses focus on restricting app consent, enforcing approval workflows, monitoring suspicious authorization events, and auditing OAuth configurations.

Successful OAuth token theft enables attackers to bypass multi-factor authentication and password resets, granting persistent access to user accounts and connected services. This can lead to account takeover, lateral movement across enterprise environments, data exfiltration without triggering credential-based alerts, and a foothold for broader supply chain or insider attacks. The persistence and scope of access tokens amplify the risk, especially in environments using OAuth-as-a-service where cross-tenant and cross-connector attacks can occur.

Organizations should disable end-user app consent for vague or impersonating app names and enforce admin-only approval workflows for OAuth app permissions. Monitoring authorization code clipboard events and continuously auditing registered redirect_uri values can help detect and prevent misuse. Because OAuth security is decentralized and depends on the identity provider, organizations should prefer major IdPs with robust protections and carefully evaluate smaller providers. Token lifetimes should be minimized to reduce the damage window. These mitigations align with vendor guidance and current best practices.