When Authentication Isn’t Enough – Understanding OAuth Token Abuse

This report explains OAuth token abuse — where attackers bypass passwords and MFA by stealing tokens or convincing users to consent to malicious OAuth apps — detailing three main attack paths (token theft, session hijacking via malicious consent screens, and device code phishing). It cites real-world breaches affecting large numbers of organisations and recommends mitigations including restricting third-party app consent, shortening token lifespans and rotation, continuous inventory of integrations, and enforcing phishing-resistant MFA.