Curated security research, vulnerabilities, advisories and tools for practitioners.

#oauth

Security coverage tagged oauth.

1.

‘I’m not the kind of person to rely on tooling’: Sn0rkY shares his Bug Bounty story and top tips

blog | 2026-10-12 11:19 | yeswehack.com | Original ↗ | .md | #ai-security | #bug-bounty | #account-takeover

2.

From Pentests to Continuous Security with Pixels

blog | 2026-09-25 12:33 | borghq.io | Original ↗ | .md | #web3 | #open-source | #pentest

3.

Propagating User Identity From AI Agents to Your Tools: Amazon Bedrock AgentCore Gateway and JFrog Artifactory

blog | 2026-08-21 16:20 | jfrog.com | Original ↗ | .md | #ai-security | #cloud | #aws

4.

Authentication Bypass in the default configuration phpBB

vulnerability | Critical | 2026-07-04 00:00 | CVE-2026-48611 | aikido.dev | Original ↗ | .md | #ai-security | #featured | #account-takeover

5.

Practice Checkpoint 4: Verifying Tokens and Claims in 3 Entra ID Authentication Flows

blog | 2026-07-11 12:13 | semperis.com | Original ↗ | .md | #access-control | #identity-security | #security-training

6.

Practice Checkpoint 2: Setting Agent Identity Permissions

blog | 2026-07-10 17:22 | semperis.com | Original ↗ | .md | #agentic-ai | #access-control | #identity-security

7.

And another one. GitHub ships break-glass credential revocation

blog | 2026-07-01 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #incident-response | #credential-security

8.

One Endpoint. Zero Credentials. Eight Confirmed Vulnerabilities.

blog | 2026-06-25 00:00 | tenzai.com | Original ↗ | .md | #ai-security | #bug-bounty | #information-disclosure

9.

Bypassing Microsoft Entra Conditional Access Policies via Nested App Authentication

blog | 2026-06-22 00:00 | netspi.com | Original ↗ | .md | #oauth | #conditional-access | #msrc

10.

Device Code Phishing: Technical Analysis and Proactive Hunting via Netlas

research | 2026-05-28 00:00 | netlas.io | Original ↗ | .md | #threat-hunting | #phishing | #oauth

11.

Keys to the Kingdom Live Stripe Credentials Exposed via Unauthenticated OAuth Endpoint

blog | 2026-05-12 11:55 | labs.cognisys.group | Original ↗ | .md | #information-disclosure | #api-security | #oauth

12.

Auditing Application Permissions in Microsoft Entra ID: Hidden Risks, Pitfalls, and Quarkslab's QAZPT Tool

research | 2026-04-29 22:00 | blog.quarkslab.com | Original ↗ | .md | #cloud-security | #active-directory | #entra-id

13.

It's time to treat browser extensions like supply chain attack vectors

incident | 2026-04-25 00:00 | aikido.dev | Original ↗ | .md | #ai-security | #supply-chain | #third-party-risk

14.

Context.ai OAuth Token Compromise

incident | 2026-04-20 18:20 | wiz.io | Original ↗ | .md | #ai-security | #supply-chain | #incident-response

15.

Would You Click ‘Accept’? Automatically detecting malicious Azure OAuth applications using LLMs

blog | 2026-02-18 19:09 | wiz.io | Original ↗ | .md | #ai-security | #cloud | #llm

16.

nOAuth Abuse Update: Potential Pivot into Microsoft 365

vulnerability | Medium | 2026-01-06 00:28 | semperis.com | Original ↗ | .md | #vulnerability-research | #attack-chains | #identity-security

17.

Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks

research | 2025-12-04 18:29 | volexity.com | Original ↗ | .md | #vulnerability-research | #threat-intelligence | #phishing

18.

3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs

blog | 2025-11-27 16:27 | wiz.io | Original ↗ | .md | #cloud | #identity-security | #entra-id

19.

How we broke exchanges: a deep dive into authentication and client-side bugs

research | 2025-10-16 12:00 | osec.io | Original ↗ | .md | #web3 | #account-takeover | #authentication

20.

SaaS Threats are Escalating: A Follow-Up to Our Recent Analysis

blog | 2025-10-14 00:00 | bishopfox.com | Original ↗ | .md | #salesforce | #oauth | #saas-security

21.

OAuth 2.0 Client Credentials Misuse in Public Apps

blog | 2025-06-19 13:35 | blog.sentry.security | Original ↗ | .md | #appsec | #mobile-security | #authentication

22.

Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows

research | 2025-04-22 12:31 | volexity.com | Original ↗ | .md | #vulnerability-research | #threat-intelligence | #phishing

23.

Web & REST API Security Explained

advisory | 2025-04-15 00:00 | aikido.dev | Original ↗ | .md | #rest-api | #api-security | #authentication

24.

The rise of device code phishing

blog | 2025-03-11 12:00 | bugcrowd.com | Original ↗ | .md | #microsoft | #phishing | #red-team

25.

Subverting Web2 authentication in Web3

blog | 2025-03-07 00:00 | osec.io | Original ↗ | .md | #web3 | #authentication | #vulnerability

26.

Breaking the Chain: Exploiting OAuth and “forgot password” for account takeover

blog | 2024-12-03 13:00 | bugcrowd.com | Original ↗ | .md | #bug-bounty | #burp-suite | #account-takeover

27.

UnOAuthorized: Privilege Elevation Through Microsoft Applications

research | 2024-08-08 00:03 | semperis.com | Original ↗ | .md | #vulnerability-research | #privilege-escalation | #entra-id

28.

Rabbit r1: Innovative Device, Security Concerns

blog | 2024-04-26 00:00 | josephthacker.com | Original ↗ | .md | #ai-security | #credential-security | #authentication

29.

Implementing API Gateways with AWS CDK for Enhanced Security and Traffic Management

blog | 2024-02-28 01:18 | hackerone.com | Original ↗ | .md | #cloud | #aws | #infrastructure-as-code

30.

Common Security Issues in Implementing OAuth 2.0 and How to Mitigate Them

blog | 2024-02-12 01:30 | hackerone.com | Original ↗ | .md | #appsec | #web-security | #authentication