[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGXYzyo5uh_13qaI7PuzufmI2vyP5COcpAdfrX5Uul7g":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"c6213837-23ff-46f7-9c6c-642cd70d5a48","mfa-is-not-enough-oauth-consent-abuse-bypasses-authentication-controls","f342587b-6523-4bd7-88cf-0925c3480304","MFA Is Not Enough: OAuth Consent Abuse Bypasses Authentication Controls","OAuth consent abuse exploits the trust model of delegated authorization, allowing attackers to trick users into granting malicious applications broad access to their data and accounts — entirely bypassing MFA, which only validates identity at login, not ongoing authorization. Once a user grants consent to a malicious OAuth app, the attacker receives persistent tokens that operate independently of the authentication session, meaning MFA provides no protection after the initial grant. This matters because many organizations falsely assume MFA is a comprehensive access control solution, leaving OAuth scopes ungoverned and token issuance unmonitored. Without strict OAuth governance, even well-secured identities can become a backdoor into sensitive resources.","**Immediate actions:**\n- Audit all existing OAuth app consents across your environment and revoke any unauthorized or overly permissive grants immediately.\n- Restrict user ability to consent to third-party OAuth applications and require administrator approval for all new app registrations.\n- Enforce least-privilege OAuth scopes by denying requests for broad permissions (e.g., mail.read, files.readwrite.all) unless explicitly justified.\n\n**Long-term improvements:**\n- Implement a formal OAuth application governance policy that includes periodic reviews, scope justification requirements, and sunset procedures for unused tokens.\n- Integrate OAuth consent events into your SIEM to establish baseline behavior and detect anomalous third-party application access patterns.\n- Adopt a Zero Trust posture for delegated access by requiring continuous validation of OAuth token usage, not just point-in-time authentication.\n\n**Detection measures:**\n- Monitor for OAuth tokens with unusually broad scopes or tokens that access resources inconsistent with the granting user's role.\n- Set up alerts for bulk consent grants, consent grants from high-privilege accounts, or apps registered outside your approved vendor list.\n- Establish automated token revocation workflows that trigger upon detection of suspicious activity or upon user account compromise.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 IA-8: Identification and Authentication","NIST SP 800-53 AU-12: Audit Record Generation","OAuth 2.0 Security Best Current Practice (RFC 9700)","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing","Microsoft Entra ID App Consent Governance Policies","MITRE ATT&CK T1550.001: Use Alternate Authentication Material – OAuth Tokens",{},"published","2026-09-18T20:20:44.612312+00:00","2026-09-18T20:20:44.491+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.darkreading.com\u002Fvulnerabilities-threats\u002Fmfa-oauth-consent-abuse","mfa-won-t-save-you-from-oauth-consent-abuse-efa1cc","MFA Won't Save You From OAuth Consent Abuse",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[53,57,61],{"slug":54,"name":55,"problem":56},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":58,"name":59,"problem":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":62,"name":63,"problem":64},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps."]