Adversaries Can “Log In with Microsoft” through the nOAuth Azure Active Directory Vulnerability

On June 20, 2023, Descope published research detailing how a combination of a flaw in Azure Active Directory and poorly integrated third-party applications — dubbed “nOAuth” — could lead to full account takeover. nOAuth is the latest in a large number of vulnerabilities and architectural weaknesses in Microsoft software and systems like Active Directory that […]

account account takeover active directory adversaries applications azure azure active directory directory featured flaw identity protection june large latest log microsoft noauth party published research research takeover third third-party vulnerabilities vulnerability weaknesses