Topic starter
01/08/2026 10:51 pm
TL;DR: Traditional SSO turns one captured authentication event into cross-app access because bearer tokens, session cookies, and federation assertions remain reusable until expiration, according to Unixi. Deterministic, app-specific credential derivation changes the trust model by reducing replay and limiting lateral movement, but it also exposes how much enterprise identity still depends on transitive trust.
Editorial analysis by NHI Mgmt Group, based on content published by Unixi: “When SSO becomes an Attack Surface Part 2”.
Key questions
Q: Why does SSO sometimes increase the blast radius of a compromised account?
A: SSO can make access simpler for users, but it also concentrates trust.
Q: How do reusable session cookies and federation assertions become a security problem?
A: They become a problem when the artifact itself is sufficient to prove identity across systems.
Q: What is the difference between transitive trust and scoped application trust in SSO?
A: Transitive trust lets one successful identity provider assertion unlock multiple downstream services automatically.
Practitioner guidance
- Map federation blast radius Inventory which applications accept the same identity provider assertion, session cookie, or token family so you can see where one captured artefact propagates trust.
- Reduce reusable authentication artefacts Where possible, move away from long-lived bearer artefacts and shared session material that can be replayed across services after the first login.
- Challenge transitive trust assumptions Review whether downstream applications should trust an upstream login event by default or require their own scoped authorization boundary.
Bottom line: Traditional SSO can multiply identity risk because reusable authentication artifacts may be replayed across multiple services.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:59 pm
Traditional SSO is an identity blast radius problem, not just an authentication problem. The article shows that reusable session tokens, bearer artefacts, and federation assertions turn a single successful login into a propagation event. That is a structural property of transitive trust, not a failure of password strength or cryptographic primitives. Practitioners should evaluate SSO on how far trust travels after the first assertion, not only on how that assertion is issued.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How should security teams reduce the blast radius of SSO compromise?
A: Security teams should shorten artifact lifetime, limit where federation trust propagates, and identify which applications can be reached from one authentication event. The goal is not just stronger login checks. It is to make captured session material less reusable, less portable, and less able to unlock unrelated systems across the environment.
👉 Read our full editorial: Traditional SSO becomes an identity attack multiplier