Updates to OAuth 2.0 Security Best Current Practice#

Tim Würtele, Pedram Hosseyni (University of Stuttgart), Kaixuan Luo (CUHK), Adonis Fung (Samsung Research America)

• Why: This documents two new real-world attack classes found in production OAuth ecosystems — including agentic AI token vaults — with 20+ and 40+ affected vendors respectively. If the PM builds anything with connector marketplaces, integration platforms, or agent toolkits, these attack classes apply directly.
• What: WG-adopted update to RFC 9700 covering: (1) audience injection attacks against client-authentication assertions, with attack mechanics and countermeasures (single audience value, issuer identifier, exact endpoint URI); (2) Cross-toolkit OAuth Account Takeover (COAT) — a malicious AS introduced via a connector/toolkit exploits mix-up defenses that don't work because issuer identifiers are unavailable, untrusted, or non-unique in practice (none of 20+ client vendors investigated applied issuer-based defenses); countermeasure: a client-assigned identifier for each toolkit, embedded in redirect_uri, matched at the client; (3) cross-user OAuth session fixation — platforms and AI token vaults introduce standalone auth sessions decoupled from the user-agent session, fixatable by sharing a request URL (Amazon Alexa, IFTTT, Microsoft Copilot, n8n, Perplexity, Manus, Bedrock AgentCore, Arcade.dev, Composio among 40+ affected); countermeasures are high-level (return to the origin where the original session lives; validate session binding), with concrete flows left to future profiling.
• How: BCP-format security analysis with per-attack threat models, generalized deployment scenarios (integration platforms, agent token vaults), and immediately applicable client-side mitigations.
• Where applicable: Every OAuth 2.0 deployment with multi-AS clients — especially connector/integration platforms and agentic token vaults. WG-adopted (-01); authors target WG last call after IETF 126.