Topic starter
16/01/2026 3:31 pm
TL;DR: OAuth tokens now underpin most SaaS-to-SaaS workflows, but stolen or hijacked tokens can bypass MFA, reuse valid authorization, and blend into normal integration traffic, according to Obsidian Security. That makes token scope, refresh-token handling, and continuous monitoring central NHI controls, not optional hardening.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “The new attack surface: OAuth Token Abuse”.
Key questions
Q: What breaks when OAuth tokens are compromised in connected SaaS environments?
A: When OAuth tokens are compromised, attackers can inherit delegated access without defeating passwords or MFA.
Q: Why do OAuth token attacks often evade normal identity detection?
A: They evade detection because the traffic comes from a valid token, a trusted app, and an authorised integration path.
Q: How should security teams reduce refresh token risk in SaaS environments?
A: Start with the basics that actually shrink blast radius: rotate tokens on every use, constrain sender context where possible, limit lifetimes by application sensitivity, and maintain fast revocation paths.
Practitioner guidance
- Govern OAuth grants as non-human identities Inventory every OAuth-connected app, service account, and integration owner, then define revocation, review, and scope rules for each grant.
- Constrain token scope and refresh behavior Reduce default scopes, rotate or revoke refresh tokens when risk changes, and avoid broad long-lived grants that can be replayed silently.
- Track consent-phishing exposure paths Review where users can approve third-party apps, especially in SaaS estates with partner ecosystems, and require tighter approval criteria for new grants.
Bottom line: OAuth abuse turns delegated SaaS access into a durable identity risk because valid tokens can outlive the original login and bypass reauthentication.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
08/10/2026 4:52 pm
OAuth token abuse is now an NHI governance problem, not just an app-integration problem. Once a token becomes the operative credential for a SaaS connection, the organisation is governing a non-human identity with lifecycle, scope, and revocation consequences. Obsidian Security's analysis shows that the attack surface is not the application itself but the delegated authority it inherits. Practitioners should treat every OAuth grant as governed access, not inert configuration.
A few things that frame the scale:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: When does consent phishing become an NHI governance issue?
A: Consent phishing becomes an NHI governance issue when a user approval creates a standing delegated grant that an application can reuse over time. The governance problem is not just the click, but the durable non-human access that follows. Teams need to treat app consent as an identity issuance event.
👉 Read our full editorial: OAuth token abuse is widening the NHI attack surface in SaaS