OAuth Consent Abuse Can Bypass MFA and Expose SaaS Data

OAuth consent abuse can give attackers persistent access to software-as-a-service (SaaS) environments even when users have signed in with multifactor authentication (MFA). In the scenario described by Dark Reading opinion contributor Vishnu Galata, a user follows a link from email, chat, a document or an issue tracker to a legitimate cloud provider’s OAuth authorisation page. The user, already authenticated, approves an apparently harmless application and its requested permissions.

Depending on the provider, application type, tenant policy and scopes granted, the attacker may then obtain tokens or application grants allowing API access until permissions are revoked or tokens invalidated.

This approach does not require password theft, malware or a fake provider domain. Approved API access could allow an attacker to search mailboxes, retrieve files, extract source code, alter repository settings, access CI/CD metadata or interact with business platforms. The article stresses that OAuth is functioning as designed; the weakness is often poor governance, including broad scopes, limited approval controls and insufficient monitoring after consent.

Conventional sign-in, endpoint and network monitoring may therefore show apparently legitimate activity, while even SIEM systems can miss newly granted applications, high-risk scopes, unusual token activity or abnormal API behaviour.

The recommended response is to restrict user approval of third-party applications, require administrator review for high-risk scopes and block or assess unfamiliar apps. Organisations should apply least privilege, monitor new app grants, service principals, refresh-token activity and unusual post-authorisation behaviour, and maintain tested procedures to identify and revoke grants, invalidate refresh tokens where supported, rotate exposed secrets and investigate connected SaaS systems.

Users should treat consent screens as security decisions, assessing why an application needs its permissions, who published it and whether the organisation approved it.