Notifications
Clear all
Topic starter
02/08/2026 11:58 am
TL;DR: Traditional SSO concentrates identity, credentials, and federation trust into a reusable attack surface, and modern identity attacks exploit that aggregation through token replay, AiTM phishing, and lateral movement, according to Unixi. The security assumption that one authenticated session can safely unlock many services is increasingly fragile in cloud and SaaS environments.
NHIMG editorial — based on content published by Unixi: Introduction: How “Traditional SSO” became an Attack Surface?
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
Questions worth separating out
Q: What breaks when traditional SSO is treated as a safe default?
A: The main failure is blast-radius expansion.
Q: Why do MFA and SSO still fail against AiTM attacks?
A: MFA protects the login event, but AiTM attacks steal the approved session after the user has already passed verification.
Q: How do security teams know if federated trust is too broad?
A: Look for one identity event that can access many systems with little or no additional policy enforcement.
Practitioner guidance
- Contain federation trust paths Inventory which applications accept upstream identity assertions or tokens without additional checks, then reduce the number of systems that can be unlocked from a single authentication event.
- Monitor for token replay indicators Add detection for impossible session reuse, unusual token issuance patterns, and access that originates from a different device or network context than the original login.
- Shorten the lifetime of reusable identity material Review the lifetime and revocation path for session cookies, OAuth tokens, and SAML assertions.
What's in the full article
Unixi's full analysis covers the operational detail this post intentionally leaves for the source:
- The article's attack-mapping discussion of T1566, T1557, T1550.001, and T1078.004 in the SSO context
- The real-world Microsoft 365 AiTM campaign breakdown, including how session cookies and OAuth tokens were captured
- The comparison of Golden SAML, Seamless SSO abuse, SolarWinds, and Okta as examples of transitive trust failure
- The vendor's localisation and containment model for reducing replay and lateral movement in federated identity
👉 Read Unixi's analysis of why traditional SSO has become an attack surface →
SSO trust expansion and token replay: are your controls keeping up?
Explore further
02/08/2026 1:05 pm
SSO has become an identity blast-radius amplifier. The original design goal was convenience, but modern federation has turned one successful login into a broad access multiplier. Once the attack surface includes session tokens, bearer assertions, and transitive trust, the relevant question is no longer whether authentication succeeded. It is how far that success can propagate before containment fails.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, which shows how weak lifecycle governance remains.
A question worth separating out:
Q: How should organisations reduce the impact of a compromised SSO identity?
A: They should reduce the blast radius of a single authenticated session by limiting SaaS connectors, removing stale delegated access, and monitoring for unusual post-login activity. A compromised SSO identity becomes far more dangerous when it can reach multiple cloud apps without additional checks.
👉 Read our full editorial: Traditional SSO has become an enterprise attack surface
