oauth 2.0

A publicly exposed appsettings.json file that contained Azure Active Directory application credentials has created a direct, programmatic attack path into affected tenants — a misconfiguration that can let attackers exchange leaked ClientId/ClientSecret pairs for OAuth 2.0 access tokens and then...

Cloud security is undergoing a steady transformation as leading platforms face mounting pressure to thwart sophisticated cyber threats. Microsoft’s recent overhaul of high-privilege access within its Microsoft 365 ecosystem marks a watershed moment, signifying an industry-wide pivot to more...

A critical authentication flaw within Microsoft’s Entra ID ecosystem continues to threaten tens of thousands of enterprise applications worldwide, illustrating a profound challenge for the current state of SaaS security two years after its discovery. The vulnerability, dubbed “nOAuth,” first...

Microsoft has announced a significant update regarding the deprecation of Basic Authentication (Basic Auth) for Exchange Online's Client Submission (SMTP AUTH). Originally slated for permanent removal in September 2025, the timeline has been extended to begin on March 1, 2026, with complete...

Microsoft has announced significant changes to its High Volume Email (HVE) service within Microsoft 365, extending support for Basic Authentication until September 2028. This extension aims to provide organizations with additional time to transition to more secure authentication methods, such as...

For many enterprise IT leaders, the intersection of security and high-volume email workflows within Microsoft 365 represents a challenging balancing act. On one hand, organizations demand robust communications infrastructure for both internal and external use. On the other, the growing threat...

Microsoft is continuing its evolution of cloud-based identity management with the unveiling of OpenID Connect (OIDC) identity provider support for Entra External ID—a move poised to fundamentally reshape the way organizations blend security, scalability, and user experience in authentication...

Russian hackers have figured out a way to weaponize OAuth 2.0 authentication—yes, that protocol you trusted implicitly last Tuesday when you breezed through another Microsoft 365 login screen—turning what should be a knight in shining armor into a digital Trojan horse galloping straight through...

There’s a certain poetic irony in the fact that OAuth 2.0—a framework specifically engineered to keep our digital lives safe from password theft—is now being bent and twisted by Russian hackers to hijack entire Microsoft 365 accounts. If that isn’t progress in the field of offensive...

Windows users and IT professionals need to take extra caution as attackers continuously refine their phishing playbook. Recent reports reveal that sophisticated adversaries are leveraging vulnerabilities in OAuth 2.0 redirection flows to target Microsoft 365 environments. In these OAuth-themed...

Every time the cybersecurity community thinks they’re getting ahead of attackers, someone comes along and turns a trusted workflow into a digital bear trap. That’s exactly what’s unfolding in the latest campaign orchestrated by Russian threat actors who are gleefully exploiting legitimate...

Security researchers and IT professionals are raising the alarm over a sophisticated new phishing variant that targets the OAuth 2.0 authorization code flow, particularly within Microsoft Azure Active Directory (Azure AD). In a detailed demonstration during the “Offensive Entra ID (Azure AD) and...