The OAuth 2.0 exploit began with a single click. One link, sent to a trusted inbox, carried no malware and triggered no antivirus alerts. It was pure social engineering.
OAuth 2.0 exists to let applications access resources without revealing user passwords. But when attackers mix protocol gaps with human trust, the results can bypass even strong technical defenses. These attacks often target the authorization flow itself, not the underlying servers. They use the user's own consent to gain access tokens — tokens that act like keys to data and APIs.
A common tactic is the malicious application. The attacker registers a legitimate-looking OAuth app with a known identity provider. They craft a consent screen mirroring a popular cloud service or SaaS tool. A victim sees the screen, clicks “Allow,” and unknowingly grants API-level access to the attacker. No password phishing needed — just a token with full scope.
Another vector is redirect manipulation. The attacker tampers with the OAuth redirect URI during a compromised login flow, tricking the identity provider into sending the access token to their server. Even minor input validation errors in redirect URIs can become critical holes.