Skip to content

The invisible key: Securing the new attack vector of OAuth tokens#

FOSDEM 2026 digest Program Core pick 31 January – 1 February 2026

Abstract Recording

Gianluca Varisco

  • Why: OAuth tokens have become the de facto target of choice for serious attackers — they bypass MFA by design and their usage is opaque to security monitoring. The PM's identity scope makes this the current-state threat talk.
  • What: The OAuth token lifecycle as an attack surface, real-world attack vectors, and actionable protection strategies — grounded in the observed TTPs of groups like ShinyHunters and Scattered Spider, including the 2025 Salesforce intrusions.
  • How: (From the program: lifecycle analysis of tokens from issuance through use, the monitoring blind spot created by opaque token activity, and defensive strategies for protecting issued tokens.)
  • Where applicable: Broadly applicable to any organization issuing OAuth/OIDC tokens; pairs naturally with the previous talk's sender-constrained-token (DPoP/mTLS) remedies. (from abstract only — no slides or paper were available)