It moved through the system like a current, crossing trust boundaries hidden in federation links. Within minutes, access levels mutated. A low-privilege account became root. This is federation privilege escalation in its pure form—an attacker exploiting identity federation to climb into roles they should never hold.
Federation connects multiple identity systems. It lets users log in once and move between apps without re-authenticating. That trust is fragile. If one part of the chain is weak—poor validation of SAML assertions, misconfigured OAuth scopes, or careless handling of OpenID Connect claims—it can be abused. The attacker injects or modifies tokens to impersonate high-privilege identities.
Privilege escalation in federated environments often hides in plain sight.
Common attack surfaces include:
- Unsigned or poorly signed federation tokens.
- Overly broad role mappings between identity providers (IdPs) and service providers (SPs).
- Failure to verify the intended audience or issuer in token validation.
- Transporting tokens over channels that expose them to interception.
Detection is harder here than in local privilege escalation. Logs in one system may not show abnormal behavior if attackers are operating through trusted federation links. They use legitimate protocols. Every request looks like it belongs.