Why do OAuth consent attacks create account takeover risk even with MFA?

Why This Matters for Security Teams

oauth consent attacks are dangerous because they shift the problem from login security to delegated access. MFA can verify the person, but it does not inspect whether the app being authorised is benign, over-privileged, or outright malicious. Once consent is granted, an attacker may gain durable programmatic access that looks legitimate to downstream systems, SIEM tooling, and even some conditional access policies.

That distinction matters in real environments where attackers target mailboxes, file stores, and SaaS integrations through approved app flows rather than password theft. NHIMG research on the State of Non-Human Identity Security found that 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which helps explain why consent abuse is so hard to spot after the fact. Guidance from CISA cyber threat advisories and the attack patterns in the The 52 NHI breaches Report both show the same pattern: the attacker does not need to defeat MFA if they can obtain authorised access through a legitimate workflow.

In practice, many security teams discover OAuth abuse only after mailbox rules, token use, or anomalous API calls have already been weaponised.

How It Works in Practice

The attack usually starts with a convincing consent prompt, a phishing link, a malicious SaaS integration, or a compromised legitimate app. The user signs in with MFA and approves scopes that may appear routine, such as reading email, offline access, or access to cloud files. That approval returns an authorisation grant or code, which the attacker exchanges for access tokens and refresh tokens. From there, the attacker operates as the user, often without needing to log in again.

This is why OAuth consent should be treated as an authorisation-control problem, not just an identity-verification problem. Practitioners need to review which apps can request consent, which scopes are allowed, and whether user consent is restricted for high-risk permissions. Admin consent workflows, app allowlists, and tenant-wide policy controls reduce exposure, but they must be paired with token monitoring, app lifecycle review, and revocation playbooks. The security lesson is reinforced by NHIMG reporting on Salesloft OAuth token breach, where stolen OAuth material was used to access SaaS data, and by NIST Cybersecurity Framework 2.0, which stresses governance, access control, and continuous monitoring rather than one-time sign-in assurance.

• Limit user-consentable scopes to low-risk applications where possible.
• Require admin approval for high-impact permissions such as mail, directory, and offline access.
• Track token issuance, unusual API calls, and consent grants as separate events.
• Revoke dormant, suspicious, or overbroad grants quickly when risk changes.

These controls tend to break down in large SaaS estates where hundreds of integrations are approved by business teams outside central security review.

Common Variations and Edge Cases

Tighter consent controls often increase operational friction, requiring organisations to balance user convenience against the risk of shadow integrations and blocked workflows. That tradeoff is real, and there is no universal standard for when to permit user consent versus require central approval.

In practice, the risk profile changes by tenant size, app type, and scope sensitivity. A low-risk productivity app may justify limited self-service consent, but access to mailbox content, calendar data, files, or directory objects should trigger stronger review. The same is true for offline access, which can outlive the user session and persist well after MFA has ended. Some environments also face delegated admin consent, multi-tenant app abuse, or supply chain compromise where the app itself is legitimate but later weaponised. This is why current guidance suggests evaluating consent policy, token lifetime, and app trust as one control system rather than separate tasks.

For deeper context on recurring identity abuse patterns, NHIMG’s 52 NHI Breaches Analysis shows how token-centric attacks repeatedly bypass traditional login assumptions, while the MITRE ATT&CK Enterprise Matrix helps teams map post-consent actions such as persistence, credential access, and lateral movement.

Consent attacks become especially hard to contain when organisations rely on legacy apps, lack app inventory, or cannot see which grants are still active across tenants and subsidiaries.

Related resources from NHI Mgmt Group

• Why do non-human identities create compliance risk even when policies exist?
• Why does SMS-based MFA still create account takeover risk?
• Why do repeated MFA prompts create account takeover risk?
• Why do AI apps and OAuth integrations create new account takeover risk in SaaS environments?