OAuth Token Abuse

Definition

OAuth token abuse is the use of a delegated authorization grant, such as an access or refresh token issued to an application or integration, to reach data and actions beyond what the granting user intended or reviewed.

How the attack works

1. 01An application receives consent, often with broader scopes than it needs
2. 02A token is issued and persists independently of the user's session
3. 03The token is obtained through a compromised integration, exposed secret or attacker-controlled app
4. 04It is used directly against the platform API
5. 05Access continues after password resets, because the grant is separate from the credential

How adversarial validation works

Within the customer side of the shared-responsibility boundary, RedMaw exercises authorized grants to establish what data and actions each one actually reaches, and whether revocation is effective.