OAuth Token Abuse: The Forgotten Enterprise Attack Surface

OAuth is the underlying mechanism behind “Sign in with Google,” “Connect to Microsoft 365,” and similar integrations across enterprise SaaS platforms. When a user authorises a third-party application, they grant it a persistent access token with defined permissions (scopes), which may include email, file systems, calendars, repositories, or messaging data.

The Vercel incident involved a third-party AI integration and broader industry reporting of an OAuth-based compromise affecting multiple organisations through trusted vendor ecosystems.

How It Works

Attackers exploit this model in two primary ways: by compromising legitimate third-party applications that already hold OAuth tokens across multiple organisations, or by creating malicious applications that trick users into granting access through convincing consent screens.

Once a token is obtained, attackers can operate through legitimate API calls using approved credentials, bypassing traditional authentication controls and avoiding MFA prompts or login alerts entirely. This allows persistent and stealthy access to enterprise SaaS environments without triggering conventional detection mechanisms.

How to Protect Your Organisation

1. Audit and Revoke Unnecessary OAuth Grants: Conduct a full review of all third-party applications connected to Microsoft 365, Google Workspace, GitHub, and other SaaS platforms. Revoke any application that cannot be clearly justified for business use.

2. Enforce OAuth Application Governance: Restrict users from granting third-party application access without security approval. Implement policies that block or flag unverified OAuth consent requests.

3. Apply Least Privilege to OAuth Scopes: Review and limit permissions granted to approved applications. Ensure integrations only receive the minimum access required for functionality.

4. Monitor OAuth Token Activity: Log and analyse token usage for anomalies such as unusual IP addresses, access patterns, or data retrieval behaviour inconsistent with expected application usage.

5. Integrate OAuth Revocation into Offboarding: Ensure employee exit procedures include revocation of all third-party application access. Treat OAuth tokens as active credentials, not passive integrations.