Phishing and OAuth Token Vulnerabilities Lead to Full Microsoft 365 Breach

This report outlines how two seemingly medium-severity web application flaws—an open/abusable email API and verbose production error messages that leak OAuth tokens—can be chained to enable authenticated phishing, Microsoft 365 data theft via the Graph API, and persistent access; it recommends input validation on public forms and suppressing detailed error output in production.