---
id: 5769
title: "nOAuth Abuse Update: Potential Pivot into Microsoft 365"
severity: medium
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/noauth-abuse-update-pivot-into-microsoft-365/"
published_at: "2026-01-06T00:28:13Z"
tags: ["vulnerability-research", "attack-chains", "identity-security", "oauth", "saas-security", "microsoft-365", "noauth"]
phying_url: "https://phying.com/item/5769"
lang: en
---

# nOAuth Abuse Update: Potential Pivot into Microsoft 365

## Summary

Follow-up nOAuth research: two of 38 newly tested SaaS apps were still vulnerable, one with permissions enabling a pivot back into Microsoft 365 — and why Semperis rates the risk severe.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2026-01-06T00:28:13Z
- **Original:** https://www.semperis.com/blog/noauth-abuse-update-pivot-into-microsoft-365/
- **Phying News:** https://phying.com/item/5769