Essential OAuth Vulnerabilities: What Security Teams Must Know

Executive Summary

In January 2025, the IETF published RFC 9700, reinforcing essential OAuth security best practices. This update addresses real-world vulnerabilities, such as Booking.com's open redirect issue and Microsoft's consent phishing challenges. Security teams must recognize that these OAuth vulnerabilities are not just theoretical; they have led to major breaches impacting thousands of organizations. The article emphasizes the urgent need for robust implementation strategies to safeguard against these actively exploited risks.

👉 Read the full article from Obsidian Security here for comprehensive insights.

Key Insights

The RFC 9700 Update

• RFC 9700 provides updated security guidelines for OAuth, drawing from historical breaches.
• It underscores critical vulnerabilities that have been exploited, affecting numerous organizations.

Real-World Breaches Linked to OAuth Vulnerabilities

• The Salesloft-Drift breach revealed how misconfigured OAuth can lead to significant data leaks.
• Allianz Life's Salesforce compromise is a prime example, exposing sensitive information of over 1.1 million customers.

Common Vulnerabilities Exploited in the Wild

• Attack patterns include Booking.com's open redirect flaw and Google’s domain inheritance vulnerability.
• Organizations often fall victim to consent phishing campaigns targeting Microsoft Entra ID environments.

Gap in Implementation vs. Design

• Many security teams mistakenly believe that their SSO and MFA setups are bulletproof against these risks.
• The reality is that attacks exploit gaps between OAuth's intended design and actual implementation practices.

Importance of Proactive Security Measures

• Emphasizes the need for continuous training and updates on OAuth vulnerabilities.
• Organizations must adopt comprehensive security measures to mitigate the risk of OAuth-related attacks.

👉 Access the full expert analysis and actionable security insights from Obsidian Security here.