Going right from @WEareTROOPERS in Heidelberg to @fwdcloudsec in Denver ✈️ - from one excellent conference to another!
I’m looking forward to speaking Monday @ 2:00pm in track 1 on the dangers of #nOAuth, with some new and tweaked slides and talking points!
At @WEareTROOPERS I dropped new research on #nOAuth, an abuse of #EntraID that allows you to spoof users in vulnerable SaaS applications.
The attack is still alive and well.
You can read all about it here:
https://www.semperis.com/blog/noauth-abuse-alert-full-account-takeover
❗️Developers of #AzureAD multi-tenant apps with #SSO based on #OpenIDConnect should take care to use immutable claims (tid + oid) of the JWT token instead of mutable claims (email) to uniquely identify and authorize access for signed-in users. #nOAuth
