OAuth token theft lets attackers bypass MFA and survive password resets
The claim
The authors assert that stealing OAuth tokens is a growing attack vector that bypasses MFA and persists after password resets.
Published as: “The Current Landscape of OAuth Attacks”
So what
Enterprises must augment MFA with continuous consent monitoring and token lifecycle controls because token theft can grant persistent access despite password changes.
The five-minute version
The writeup surveys recent OAuth phishing campaigns and explains how attackers harvest access and refresh tokens to gain durable access. It reports that 18.53% of surveyed OAuth sites request overly broad permissions, illustrating the prevalence of risky consent grants. The authors describe three attack categories-account hijacking, permission hijacking, and malicious redirects-and propose defenses such as centralized consent policies and redirect URI auditing. Evidence is based on a large-scale analysis of OAuth implementations and observed threat-kit templates, but no quantitative evaluation of the proposed mitigations is provided.
What they found 1
- A significant fraction of OAuth implementations request excessive permissions
“A large-scale analysis of OAuth websites found that 18.53% of these sites request permissions beyond the minimum required (typically just a user's profile and email).”
What undercuts it the paper’s own results
- While OAuth misuse occurs at a lower volume than traditional phishing attacks
Stated limits 2
- While OAuth misuse occurs at a lower volume than traditional phishing attacks
- The root challenge is the lack of a global registry for Client IDs
What’s new here 4
- Quantifies that 18.53% of OAuth sites request permissions beyond the minimum required
- Classifies OAuth phishing into three distinct attack types
- Highlights the use of LLM-generated phishing templates and Phishing-as-a-Service kits
- Recommends centralized, automated consent policies to block vague or impersonating apps
Artifacts & methods 5
- OAuth token theftprimitive
- Device Authorization flow misuseprimitive
- Authorization code theft via benign appsprimitive
- Phishing-as-a-Service (PhaaS) templatesprimitive
- LLM-generated brand impersonationsprimitive