Start with Identity
Control · 3 briefs

Attacks on authorization

Techniques that leave the login alone and attack what an authenticated identity is allowed to do: consent abuse, scope escalation, and delegation chains that quietly widen access.

Why this control fails

Authorization failures are harder to spot than authentication failures because the request came from a real, logged-in user. A malicious or over-permissioned OAuth app that asks for offline_access and broad scopes at consent time gets standing access that outlives the interactive session and does not show up as an anomalous login. Delegation chains compound the problem: an app that can act as a service, which can act as another service, ends up with a combined scope that no single approver ever reviewed. RBAC and ABAC systems fail the same way when role or attribute definitions drift from what the business actually needs, so "authorized" and "appropriate" quietly stop meaning the same thing.

What security people should do

  • Scope OAuth consent narrowly and review which third-party apps hold offline_access or admin-level grants at least quarterly.
  • Validate scopes on every API call server-side, never trust a scope claim in a token without checking it against the resource being accessed.
  • Map delegation and impersonation chains explicitly and cap how many hops a token can be exchanged through.
  • Recertify roles and attribute policies against current job function, not the ticket that created them.

Techniques in this category

Seeing this attack in production and have a detection idea we should add? Email [email protected] or volunteer as a CVE Analyst.