Topic starter
15/08/2026 6:10 pm
TL;DR: OAuth tokens, session cookies, and API keys let attackers bypass MFA entirely in SaaS environments, according to Obsidian Security’s analysis of Salesloft-Drift and related token abuse patterns. The real issue is post-authentication access governance: once a bearer credential exists, traditional login-centric controls no longer define the trust boundary.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “MFA Bypass Explained: Why Traditional Auth Fails & Prevention Tips”.
Key questions
Q: What breaks when SaaS access is governed only at the account level?
A: Account-level governance misses the session, grant and integration layers where SaaS access is actually exercised.
Q: What breaks when a platform stores customer OAuth tokens and API keys without governance?
A: The platform stops being a neutral integration layer and becomes a delegated access repository with live production reach into customer systems.
Q: How should security teams handle token theft in SaaS environments?
A: Treat tokens as delegated non-human identities, not disposable implementation details.
Practitioner guidance
- Inventory all bearer credentials across SaaS integrations Build a complete register of OAuth tokens, refresh tokens, session cookies, API keys, and service accounts that can access SaaS applications outside the primary login flow.
- Revoke long-lived tokens on ownership change Tie token revocation to offboarding, vendor change, application replacement, and suspected compromise so credentials do not survive the relationship that created them.
- Add behavioural detection for valid-token abuse Monitor API calls, source geography, velocity, and endpoint sequences so legitimate credentials that are being reused by attackers stand out from normal traffic.
Bottom line: The article shows that MFA is only one layer of SaaS protection, and valid tokens can continue to authorise access after the user challenge is complete.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:18 pm
MFA bypass is really a post-authentication governance problem: once a bearer credential exists, the trust boundary shifts away from the login event and into the token lifecycle. That makes login-centric assurance insufficient for SaaS estates built on OAuth, session cookies, and API keys. Practitioners need to treat issued credentials as the real access plane, because that is where abuse now happens.
Hidden-layer credential governance: MFA will keep looking effective if teams only measure login success, but SaaS compromise increasingly happens after authentication through valid bearer credentials. Security programmes need to move their control point from the front door to the credential itself, especially where integrations and service access blur human and non-human ownership.
A question worth separating out:
Q: What should organisations do when a SaaS integration is no longer needed?
A: They should revoke the connection, remove its tokens or service account access, and confirm the data path is no longer active. Offboarding has to cover both the app relationship and the authorizations it accumulated, otherwise the integration can remain a trusted route into data long after the business use case ends.
👉 Read our full editorial: MFA bypass in SaaS exposes the hidden layer of NHI risk