Proof of Possession (PoP)
Proof of possession (PoP) is a property of a token or credential that requires the presenter to show it controls a specific cryptographic key, so holding the token alone is not enough to use it. RFC 7800 defines how a JWT names its PoP key in the cnf (confirmation) claim.
PoP is the answer to the bearer token problem, where anyone who copies a token can replay it. In OAuth, RFC 8705 binds access tokens to the client's TLS certificate through mutual TLS, and RFC 9449 (DPoP) has the client sign a short proof with its key on each request, which suits browser and mobile apps that cannot present client certificates; FAPI 2.0 requires one or the other. The same principle applies to client authentication: in October 2026 a CVSS 10 flaw in the SAP Cloud SDK for Python sent OAuth client IDs and secrets to an attacker-controlled host, whereas a client authenticating with a private key over mTLS never transmits anything an attacker could reuse.
See also: DPoP, mTLS, bearer token, token replay on unbound endpoints, FAPI
Related on Start with Identity
- GlossaryCertificate Lifecycle Management
Discovering, issuing, renewing, and revoking TLS and other certificates across an organization. Automation matters because expired or unmanaged certificates cau
- GlossaryPKI
Public Key Infrastructure. The system of certificate authorities, certificates, and keys that binds public keys to identities. Underpins TLS, code signing, and
- GlossaryDevice Bound Session Credentials (DBSC)
Device Bound Session Credentials (DBSC) is a web standard that binds a browser session to a private key held in the device's hardware, so a session cookie stole
- BlogSharePoint JWT bypass went from proof of concept to exploitation in under 48 hours
Rapid7 published a working PoC for CVE-2026-55040 in mid-August. Exploitation telemetry spiked from one attempt to eight the following day, from eight IPs acros