oauth
70 articles with this tag
INFO
HIGH
HIGH
INFO
HIGH
MEDIUM
MEDIUM
CRITICAL
CRITICAL
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
MEDIUM
HIGH
HIGH
CRITICAL
MEDIUM
INFO
HIGH
HIGH
INFO
MEDIUM
CRITICAL
HIGH
INFO
HIGH
HIGH
HIGH
INFO
MEDIUM
LOW
MEDIUM
CRITICAL
HIGH
HIGH
HIGH
HIGH
INFO
HIGH
HIGH
MEDIUM
HIGH
INFO
MEDIUM
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
MEDIUM
HIGH
INFO
HIGH
MEDIUM
MEDIUM
HIGH
MEDIUM
HIGH
HIGH
HIGH
HIGH
INFO
OAuth and OIDC: Token Flows, Scopes, and Common Attack Vectors
FBI raises alarm over deceptive phishing campaign targeting prominent people
Password spraying attacks surge 155x, exploiting legacy authentication flaws
From all-or-nothing to task-based OAuth consent
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia
NCSC-2026-0320 [1.00] [M/H] Kwetsbaarheden verholpen in Zabbix
4 million fake applications and one blind spot: A SOC playbook for OAuth client ID spoofing
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026
[$13337] Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking
OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials
USN-8557-1: Authlib vulnerabilities
CVE-2026-57219 RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations
ShinyHunters group exploits OAuth trust, prompting Microsoft security upgrades
OAuth client ID spoofing silently validates stolen Microsoft Entra ID credentials
OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials
RabbitMQ fixes flaw that allowed broker takeover via OAuth secret disclosure
Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths
KlueセキュリティインシデントとRecorded Futureへの影響
Cybercriminals exploit OAuth client ID spoofing to bypass cloud security
Novel OAuth Client ID Spoofing Technique Targets Cloud Environments
RabbitMQ flaws expose OAuth secrets, risk complete takeover of the broker
Fake OAuth client IDs are helping attackers slip past sign-in logs
Introducing OAuth Support for AWS MCP Server
Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs
When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website
How to prioritize AI agent security by business impact
NCSC-2026-0219 [1.00] [M/H] Kwetsbaarheden verholpen in GitHub Enterprise Server
ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API
We Need to Talk About Device Code Phishing
Unlocking the Cloudflare app ecosystem with OAuth for all
Klue breach exposed Salesforce CRM data through stolen OAuth tokens
Klue OAuth breach victim list grows as Icarus hackers claim attack
Icarus threat actors exploit Klue OAuth breach to steal Salesforce data
[Security Blog] Understanding OAuth Risks: From Device Code Phishing to Token Abuse
Major AI Clients Shipping With Broken OAuth Implementations (JUNE 2026 UPDATE)
OAuth marketplace apps keep access after publishers vanish
Another bug hunter leaks Microsoft exploits in defiance of company’s handling of vulnerability disclosures
One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens
FBI Warns 'Kali365' Phishing Kit Hijacks Microsoft 365 OAuth Tokens
FBI warns about fast-growing phishing kit targeting Microsoft 365 users
FBI warns of Kali Oauth stealers
Tycoon2FA phishing kit evolves with device-code attacks on Microsoft 365
Claude Code OAuth Tokens Can Be Stolen Through Stealthy MCP Hijacking
The Back Door Attackers Know About — and Most Security Teams Still Haven’t Closed
ConsentFix v3 attacks target Azure with automated OAuth abuse
Major AI Clients Shipping With Broken OAuth Implementations
The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables
Learning from the Vercel breach: Shadow AI & OAuth sprawl
Vercel Hacked: A Simple Failure of OAuth Hygiene | THREAT WIRE
Vercel Breach Explained: OAuth Risk in AI + SaaS Environment
Hackers exploit Vercel’s trust in AI integration
Next.js developer Vercel warns of customer credential compromise
AI-enabled device code phishing campaign exploits OAuth flow for account takeover
Device code phishing attacks surge 37x as new kits spread online
New EvilTokens service fuels Microsoft device code phishing attacks
Critical Vulnerability in OpenAI Codex Allowed GitHub Token Compromise
OAuth Consent and Device Code Phishing for Red Teams
Microsoft Entra OAuth Consent Grant Attack Simulation in the PhishU Framework
ThreatsDay Bulletin: OAuth Trap, EDR Killer, Signal Phishing, Zombie ZIP, AI Platform Hack & More
OAuth vulnerability in n8n automation platform could lead to system compromise
OAuth redirection abuse enables phishing and malware delivery
Attackers abuse OAuth’s built-in redirects to launch phishing and malware attacks
Microsoft: Hackers abuse OAuth error flows to spread malware
Threat actors weaponize OAuth redirection logic to deliver malware
OAuth phishers make ‘check where the link points’ advice ineffective
OAuth redirection abuse enables phishing and malware delivery
New phishing campaign tricks employees into bypassing Microsoft 365 MFA
Hackers target Microsoft Entra accounts in device code vishing attacks
Blue Team | Hunting Cloud Persistence Without Malware