Every story tagged Oauth, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
6 stories · open in the command center
CVE-2026-67333 is a high-severity OAuth redirect URI validation flaw in better-auth that allows attackers to execute JavaScript in the authorization server's origin, potentially enabling account takeover through XSS attacks. Organizations using better-auth versions before 1.6.13 or beta versions 1.7.0-beta.0 through beta.3 with the deprecated oidc-provider or mcp plugins face immediate risk to authentication security and user session integrity. IT leaders must prioritize patching this vulnerability to prevent compromise of identity and access management infrastructure.
Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication (client_secret_jwt and private_key_jwt token endpoint authentication methods) but never enforces that the assertion's exp claim is in the future. The pre-check helper Boruta.Oauth.Request.Base.check_expiration/1 in lib/boruta/oauth/request/base.ex only verifies that an exp claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, Boruta.Oauth.Authorization.Client.Token.token_config/0 in lib/boruta/oauth/authorization/client.ex, returns an empty map, so Joken's default exp claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser...
Cloudflare has opened self-managed OAuth to all customers, enabling developers to build integrations with delegated access and improved security controls—a strategic move to scale their developer platform and meet demand from AI/agentic tools. This required significant infrastructure upgrades to their OAuth engine, including careful blue-green migration strategies and enhanced consent/revocation mechanisms to maintain security and uptime during the transition. For IT organizations, this represents both an opportunity to implement more secure, granular access control for Cloudflare integrations and a technical lesson in managing zero-downtime infrastructure migrations at scale.
Enterprise-Managed Authorization (EMA) for Model Context Protocol now enables zero-touch OAuth through centralized identity provider control, eliminating per-user authentication friction and allowing organizations to manage MCP server access through a single login with consistent security policies and audit trails. Major identity providers (Okta), AI platforms (Anthropic, Microsoft), and productivity tools (Figma, Linear, Asana) have adopted this extension, creating a new baseline for enterprise AI tool integration that improves security posture while accelerating employee productivity. This shift from user-scoped to organization-scoped authorization represents a significant change in how enterprise AI infrastructure will be governed and secured going forward.
The Vercel breach demonstrates a critical blind spot in enterprise security: OAuth token theft through compromised third-party applications, which most security teams cannot detect or contain. The attack chain—spanning an infected employee device, compromised vendor AWS environment, and unmonitored OAuth grants with overly broad permissions—reveals that organizations lack visibility into third-party application authorization patterns and cannot correlate stealer malware activity with downstream cloud access. For IT leaders, this exposes a strategic gap in cloud governance: the need for OAuth token monitoring, third-party application access controls, and behavioral analytics across identity and cloud platforms, as traditional EDR and CASB solutions miss the critical lateral movement phases of this attack.
A compromised third-party OAuth application at Context.ai gave attackers 22-month access to Vercel's internal systems, exposing customer environment variables and API keys that weren't explicitly marked as sensitive. This supply chain attack demonstrates how OAuth trust relationships bypass traditional security perimeters and how platform-level design choices around credential storage can massively amplify breach impact across downstream customers. The incident highlights a concerning 2026 pattern of attackers systematically targeting developer-stored credentials across CI/CD pipelines, deployment platforms, and OAuth integrations.