Topic starter
25/06/2026 12:52 am
TL;DR: Misused OAuth tokens linked to the Salesloft Drift integration enabled unauthorized access to Salesforce data between August 8 and 18, 2025, affecting hundreds of customers, according to Omada Identity. The incident shows how third-party OAuth exposure can outpace visibility, offboarding, and trust controls for NHI governance.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “Omada Statement on Salesforce - Salesloft Drift Incident”.
Key questions
Q: What breaks when OAuth access is not governed like a non-human identity?
A: Access persists beyond the user session that created it, so the organisation loses the usual sign-in checkpoints that would normally bound use.
Q: Why do OAuth tokens increase lateral movement risk in SaaS environments?
A: OAuth tokens increase lateral movement risk because they can remain valid after the initial user session, bypass MFA, and preserve scoped access until revoked.
Q: How can teams tell whether SaaS governance is actually working?
A: Look for evidence that discovered applications can be assigned an owner, tied to an access policy, and removed through an enforced workflow.
Practitioner guidance
- Map every third-party OAuth grant Build an inventory of Salesforce-connected applications, the scopes they hold, and the business owner responsible for each grant.
- Offboard dormant integrations on a schedule Remove unused app connections and require reapproval for any integration that has not been actively justified within a defined review cycle.
- Reduce delegated access scope Review whether each third-party app needs read, write, or admin-level access and remove any scope that is not operationally necessary.
Bottom line: The incident shows how third-party OAuth misuse can turn a trusted integration into an access path that bypasses normal human authentication controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 24 hours ago by NHI Mgmt Group
25/06/2026 9:56 am
Third-party OAuth access is now a governed identity problem, not a vendor integration detail. The incident sits in the same category as service-account sprawl because the organisation has delegated access to a non-human actor and then allowed the lifecycle to drift. When hundreds of customers can be affected through a trusted app connection, the control failure is governance over delegated access, not just token security. Practitioners should treat every external OAuth grant as an accountable identity relationship.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do after discovering misuse of a third-party integration token?
A: Disable the token, disconnect the application, confirm the scope that was active during the exposure window, and assess whether any downstream data was accessible beyond the core system. Then review other integrations that share the same trust model, because one compromised app often reveals a wider lifecycle problem. Response should end in governance review, not only containment.
👉 Read our full editorial: Salesloft Drift token misuse exposes Salesforce NHI governance gaps
This post was modified 24 hours ago by NHI Mgmt Group