Attacks on authorization
Techniques that leave the login alone and attack what an authenticated identity is allowed to do: consent abuse, scope escalation, and delegation chains that quietly widen access.
Why this control fails
Authorization failures are harder to spot than authentication failures because the request came from a real, logged-in user. A malicious or over-permissioned OAuth app that asks for offline_access and broad scopes at consent time gets standing access that outlives the interactive session and does not show up as an anomalous login. Delegation chains compound the problem: an app that can act as a service, which can act as another service, ends up with a combined scope that no single approver ever reviewed. RBAC and ABAC systems fail the same way when role or attribute definitions drift from what the business actually needs, so "authorized" and "appropriate" quietly stop meaning the same thing.
What security people should do
- Scope OAuth consent narrowly and review which third-party apps hold offline_access or admin-level grants at least quarterly.
- Validate scopes on every API call server-side, never trust a scope claim in a token without checking it against the resource being accessed.
- Map delegation and impersonation chains explicitly and cap how many hops a token can be exchanged through.
- Recertify roles and attribute policies against current job function, not the ticket that created them.
Techniques in this category
A broker sitting between users and a shared backend fails to keep sessions apart, so a token supplied by one caller gets used to serve a different caller's later request, with no attack step beyond timing.
The victim never types a password. They click a legitimate 'Sign in with' button, land on the real identity provider, and approve an attacker-registered application's request for mailbox and file access.
A chain of services each meant to narrow a token's authority instead widens it, because one hop in the delegation path trusts the scope a caller claims rather than the scope it was actually issued.