[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcdqWjC9DLPyK5cZiTIfZvhievDl-DuuHy1mYpBcUfe0":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"9221b034-49b5-4222-b5e5-246cdb576891","OAuth grants pile up faster than you can review them. Here's how to keep up.","oauth-grants-pile-up-faster-than-you-can-review-them-here-s-how-to-keep-up-f5b86e","OAuth grants create data highways between SaaS apps, AI agents, and other tools. And, they are multiplying faster than any security team can review them. As the recent Klue breach showed, attackers are taking notice and exploiting forgotten OAuth grants to gain access to corporate data. This article covers why OAuth risks are so hard [...]","OAuth grants are proliferating across organizations—averaging 88 per employee with 31 carrying data-level permissions—yet they operate outside standard identity controls and can persist long after employee credentials are disabled. Recent breaches like Vercel and Klue exploited forgotten OAuth grants, and Gartner predicts 50% of SaaS breaches will stem from overprivileged OAuth tokens by 2027. Manual review of individual grants takes ~45 minutes each, making it impossible for security teams to audit tens of thousands of grants without automation and agentic capabilities.","OAuth grants accumulate faster than security teams can review, creating exploitable data access pathways.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Foauth-grants-pile-up-faster-than-you-can-review-them-heres-how-to-keep-up\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F10\u002F07\u002F0_oauth-grant-header-1600.jpg","2026-10-08T14:00:10+00:00","2026-10-08T16:00:27.052694+00:00",7,[17,20,22,24,26,28],{"name":18,"type":19},"Nudge Security","vendor",{"name":21,"type":19},"Google",{"name":23,"type":19},"Microsoft",{"name":25,"type":19},"Vercel",{"name":27,"type":19},"Context.ai",{"name":29,"type":30},"OAuth","technology","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":31,"icon":33,"name":34,"slug":35},null,"Identity & Access","identity-access",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[21,23,18],{"controls":55,"vendors":139},[56,85,113],{"slug":57,"name":58,"problem":59,"products":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":86,"name":87,"problem":88,"products":89},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":107,"vendor_name":23,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":114,"name":115,"problem":116,"products":117},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[118,124,131],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":119,"product_name":120,"url":122,"description":123},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":126,"url":129,"description":130},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":157},"unmanaged-oauth-grants-create-shadow-access-risk-across-saas-ecosystems","Unmanaged OAuth Grants Create Shadow Access Risk Across SaaS Ecosystems","OAuth grants accumulate silently across organizations—averaging 88 per employee—yet they exist largely outside standard identity governance processes, meaning they are rarely reviewed or revoked. When an employee leaves or a third-party app is no longer needed, the associated OAuth token often persists indefinitely, providing a persistent backdoor attackers can exploit. Breaches at Vercel and Klue demonstrate that these forgotten grants are not theoretical risks but active attack vectors. The sheer volume of grants makes manual auditing impractical, leaving organizations blind to overprivileged third-party access at scale. Without automation, security teams cannot maintain visibility or enforce least-privilege across the full OAuth surface area.",[145,146,147,148,149,150,151,152,153,154,155,156],"CIS Control 4: Controlled Use of Administrative Privileges","CIS Control 6: Access Control Management","CIS Control 16: Application Software Security","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 AU-6: Audit Review, Analysis, and Reporting","NIST CSF ID.AM-3: Organizational communication and data flows are mapped","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing","ISO 27001 A.9.2.6: Removal or Adjustment of Access Rights","ITIL Change Management: Unauthorized Change Detection",{"NIST SP 800-53 AC-6: Least Privilege":158,"GDPR Article 32: Security of Processing":159,"NIST SP 800-53 AC-2: Account Management":160,"CIS Control 6: Access Control Management":161,"CIS Control 16: Application Software Security":162,"NIST SP 800-53 IA-5: Authenticator Management":163,"ITIL Change Management: Unauthorized Change Detection":164,"GDPR Article 25: Data Protection by Design and by Default":165,"ISO 27001 A.9.2.6: Removal or Adjustment of Access Rights":166,"CIS Control 4: Controlled Use of Administrative Privileges":167,"NIST SP 800-53 AU-6: Audit Review, Analysis, and Reporting":168,"NIST CSF ID.AM-3: Organizational communication and data flows are mapped":169},"Least privilege limits OAuth scopes to what each app genuinely needs.","Appropriate security includes managing third-party app access to personal data.","Account management includes revoking OAuth grants when employees leave, closing shadow access.","Access control management should include OAuth grants, which often escape standard identity governance.","Application security includes reviewing third-party apps and the scopes they request.","Authenticator management includes OAuth tokens, which should be tracked and revoked when no longer needed.","Detecting unauthorised changes includes new OAuth grants that bypass governance.","Data protection by default limits what third-party apps can access through OAuth.","Removing access rights on role change or departure should include OAuth grants.","Controlling administrative privileges includes limiting high-risk OAuth scopes that grant broad access.","Reviewing audit records of OAuth grants helps detect risky or unused app access.","Mapping data flows to third-party apps helps identify where OAuth grants expose data."]