The token was granted. The scope list looked harmless. Minutes later, the attacker owned the account.
OAuth scopes define what an application can do with a user’s data. They are gates. But when scope management breaks, those gates swing wide, giving attackers paths to privilege escalation. Misconfigured or overbroad scopes let a low-privilege OAuth token perform high-privilege actions. This is not theoretical. Real breaches start with small permissions that chain into full control.
Privilege escalation through OAuth happens in stages. First, a token is issued with more scopes than needed. Second, the application or API trusts that token for sensitive operations. Third, the attacker exploits the token to move from limited access to administrative functions. In many cases, this happens because scopes are assigned dynamically, based on user or app context, without proper restrictions.
Common risks include mixed trust boundaries, implicit granting of high-value scopes during consent, and relying on static scope validation. Some APIs fail to enforce true least privilege, allowing management scopes to slip through unnoticed. Scope creep is another danger—new features introduce new scopes that overlap with powerful management actions, creating escalation vectors.