Curated security research, vulnerabilities, advisories and tools for practitioners.

#oauth

Security coverage tagged oauth.

1.

Propagating User Identity From AI Agents to Your Tools: Amazon Bedrock AgentCore Gateway and JFrog Artifactory

blog | 2026-08-21 16:20 | jfrog.com | original ↗ | #ai-security | #cloud | #aws

2.

Authentication Bypass in the default configuration phpBB

vulnerability | Critical | 2026-07-04 00:00 | CVE-2026-48611 | aikido.dev | original ↗ | #ai-security | #featured | #account-takeover

3.

Practice Checkpoint 4: Verifying Tokens and Claims in 3 Entra ID Authentication Flows

blog | 2026-07-11 12:13 | semperis.com | original ↗ | #access-control | #identity-security | #security-training

4.

Practice Checkpoint 2: Setting Agent Identity Permissions

blog | 2026-07-10 17:22 | semperis.com | original ↗ | #agentic-ai | #access-control | #identity-security

5.

And another one. GitHub ships break-glass credential revocation

blog | 2026-07-01 00:00 | aikido.dev | original ↗ | #supply-chain | #incident-response | #credential-security

6.

One Endpoint. Zero Credentials. Eight Confirmed Vulnerabilities.

blog | 2026-06-25 00:00 | tenzai.com | original ↗ | #ai-security | #bug-bounty | #information-disclosure

7.

Device Code Phishing: Technical Analysis and Proactive Hunting via Netlas

research | 2026-05-28 00:00 | netlas.io | original ↗ | #threat-hunting | #phishing | #oauth

8.

Keys to the Kingdom Live Stripe Credentials Exposed via Unauthenticated OAuth Endpoint

blog | 2026-05-12 11:55 | labs.cognisys.group | original ↗ | #information-disclosure | #api-security | #oauth

9.

Auditing Application Permissions in Microsoft Entra ID: Hidden Risks, Pitfalls, and Quarkslab's QAZPT Tool

research | 2026-04-29 22:00 | blog.quarkslab.com | original ↗ | #cloud-security | #active-directory | #entra-id

10.

It's time to treat browser extensions like supply chain attack vectors

incident | 2026-04-25 00:00 | aikido.dev | original ↗ | #ai-security | #supply-chain | #third-party-risk

11.

Context.ai OAuth Token Compromise

incident | 2026-04-20 18:20 | wiz.io | original ↗ | #ai-security | #supply-chain | #incident-response

12.

Would You Click ‘Accept’? Automatically detecting malicious Azure OAuth applications using LLMs

blog | 2026-02-18 19:09 | wiz.io | original ↗ | #ai-security | #cloud | #llm

13.

nOAuth Abuse Update: Potential Pivot into Microsoft 365

vulnerability | Medium | 2026-01-06 00:28 | semperis.com | original ↗ | #vulnerability-research | #attack-chains | #identity-security

14.

3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs

blog | 2025-11-27 16:27 | wiz.io | original ↗ | #cloud | #identity-security | #entra-id

15.

How we broke exchanges: a deep dive into authentication and client-side bugs

research | 2025-10-16 12:00 | osec.io | original ↗ | #web3 | #account-takeover | #authentication

16.

SaaS Threats are Escalating: A Follow-Up to Our Recent Analysis

blog | 2025-10-14 00:00 | bishopfox.com | original ↗ | #salesforce | #oauth | #saas-security

17.

OAuth 2.0 Client Credentials Misuse in Public Apps

blog | 2025-06-19 13:35 | blog.sentry.security | original ↗ | #appsec | #mobile-security | #authentication

18.

Web & REST API Security Explained

advisory | 2025-04-15 00:00 | aikido.dev | original ↗ | #rest-api | #api-security | #authentication

19.

The rise of device code phishing

blog | 2025-03-11 12:00 | bugcrowd.com | original ↗ | #microsoft | #phishing | #red-team

20.

Subverting Web2 authentication in Web3

blog | 2025-03-07 00:00 | osec.io | original ↗ | #web3 | #authentication | #vulnerability

21.

Breaking the Chain: Exploiting OAuth and “forgot password” for account takeover

blog | 2024-12-03 13:00 | bugcrowd.com | original ↗ | #bug-bounty | #burp-suite | #account-takeover

22.

UnOAuthorized: Privilege Elevation Through Microsoft Applications

research | 2024-08-08 00:03 | semperis.com | original ↗ | #vulnerability-research | #privilege-escalation | #entra-id

23.

Rabbit r1: Innovative Device, Security Concerns

blog | 2024-04-26 00:00 | josephthacker.com | original ↗ | #ai-security | #credential-security | #authentication

24.

Implementing API Gateways with AWS CDK for Enhanced Security and Traffic Management

blog | 2024-02-28 01:18 | hackerone.com | original ↗ | #cloud | #aws | #infrastructure-as-code

25.

Common Security Issues in Implementing OAuth 2.0 and How to Mitigate Them

blog | 2024-02-12 01:30 | hackerone.com | original ↗ | #appsec | #web-security | #authentication

26.

iOS App Secret Management: Best Practices for Keeping Your Data Secure

blog | 2024-02-09 08:37 | hackerone.com | original ↗ | #appsec | #secrets-management | #mobile-security

27.

Midnight Blizzard attack on Microsoft corporate environment: a detailed analysis, detections and recommendations

blog | 2024-02-08 18:00 | wiz.io | original ↗ | #threat-detection | #microsoft | #oauth

28.

Security flaws in an SSO plugin for Caddy

blog | 2023-09-18 12:00 | blog.trailofbits.com | original ↗ | #cloud | #security-audit | #xss

29.

Detecting web message misconfigurations for cross-domain credential theft

research | 2022-11-09 14:13 | portswigger.net | original ↗ | #burp-suite | #credential-theft | #dom-invader

30.

Kiteworks’ New Program Promotion

blog | 2022-03-03 00:00 | bugcrowd.com | original ↗ | #bug-bounty | #rce | #sql-injection