Breaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
summary
Shows a 2025 Salesforce OAuth breach where a single integration token lets attackers access 7,000+ customer environments, reproduces token replay against a microservices gateway using Burp Suite repeater/intruder and a live lab at sec.securify.co, and demonstrates MFA-evading token theft (Storm‑2372 style). Proves bearer tokens are reusable across services, then builds and validates a mitigation: TPOP proof-of-possession with client key pairs, plus practical fixes—granular scopes, separate IDP configs, shorter expirations, composite identities and IDP‑bound privileges.
AI-written summary · about
chapters (8)
- 0:00Introduction and agenda
- 1:04Salesforce token breach case study
- 3:54Modern token validation challenges
- 5:17Breaking microservices with token replay
- 12:00Bearer token replay attack
- 19:01Federated identity confusion
- 27:05Mitigations for token attacks
- 29:12Q&A session
related talks
59m{JWT}.{Misuse}.&Abuse
35mAttacks on JSON Web Tokens: A Comprehensive Analysis
33mYour Identity Is Mine: Techniques & Insights From OS Identity Providers Research
22mAPI Authentication Deep Dive: OAuth 2.0, Tokens, and JWTs
36mHow To Hack OAuth｜
53mOAuth2/OIDC security weaknesses and pitfalls
31mThe Hacker's Guide to JWT Security
57mThe insecurity of OAuth 2.0 in frontends