Topic starter
06/06/2026 2:34 am
TL;DR: Consent phishing turns legitimate OAuth consent prompts into persistent token-based access without stealing passwords, because users can approve scopes on the real identity provider and attackers then hold refresh tokens, according to WorkOS. The weak point is governance, not authentication: access review and password resets do not address delegated grants that outlive the session.
Editorial analysis by NHI Mgmt Group, based on content published by WorkOS: “OAuth governance and consent phishing: What engineers need to know”.
Key questions
Q: What breaks when users can grant OAuth consent to risky applications?
A: The control that breaks is the assumption that a valid login equals safe delegated access.
Q: Why do AiTM phishing kits still succeed against MFA?
A: AiTM kits succeed because they capture the authenticated session, not just the password.
Q: What are the signs that OAuth consent governance is failing?
A: Common signs include broad scopes granted to unfamiliar applications, app registrations that survive beyond their business purpose, and consent events that are logged but not acted on.
Practitioner guidance
- Restrict user OAuth consent Block broad self-consent where possible and allow only verified, low-risk apps to receive user-granted scopes without review.
- Stand up an admin approval workflow Route user requests for new OAuth access to security or platform reviewers, and require the business purpose, publisher status, and requested scopes to be checked.
- Inventory existing OAuth grants Review current consent grants and app role assignments for broad scopes, unverified publishers, and refresh tokens that remain active without recent use.
Bottom line: Consent phishing succeeds because the trust decision sits at the OAuth consent screen, where users can grant durable access without compromising their password.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 4:19 am
Consent is the control plane, not the user click: OAuth consent prompts are access decisions that can outlive the authentication event itself. Once a user approves scopes on the real identity provider, the resulting grant behaves like a durable non-human access path with its own lifecycle. The practitioner conclusion is that consent governance belongs in the identity model, not in user awareness training alone.
A few things that frame the scale:
- Security researchers tracked consent phishing campaigns affecting 900 tenants and 3,000 user accounts in 2025.
A question worth separating out:
Q: Should organisations revoke refresh tokens immediately after a suspected consent phishing incident?
A: Yes. Password resets alone do not remove token-based access, so revocation has to be part of containment. Security teams should revoke the malicious application grant, invalidate the affected user’s refresh tokens, and review API activity tied to the app’s client ID before assuming the incident is contained.
👉 Read our full editorial: OAuth consent phishing exposes the governance gap in identity