Loading story…
elttam disclosed an Auth0 tenant attack chain in which an XSS flaw in one application can expose a victim's access token and enable pivots to other resources in the same Auth0 tenant. The chain depends on the Implicit Grant Flow being enabled by default, API access policies that allow all tenant applications, and backend APIs that accept tokens without validating the authorized-party (azp) claim.
Attackers can also abuse user access to the Auth0 Management API and the update:current_user_identities scope to link an attacker-controlled identity to a victim account after persuading the victim to consent. Organizations should disable Implicit Grant Flow, limit API access to explicitly approved applications, validate azp server-side, remove user access to the Management API where unnecessary, and require step-up authentication for sensitive account changes.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A post on r/netsec referenced elttam's article, “Exploiting Auth0 Defaults in XSS Attacks.”
elttam documented how XSS in one Auth0 tenant application can obtain a victim token and pivot to other tenant resources when Implicit Grant is enabled, API policies are overly broad, and backend APIs do not validate the azp claim. The research also described Management API account-linking abuse through the update:current_user_identities scope and recommended configuration and validation mitigations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of security research articles and reports have highlighted critical vulnerabilities in web application authentication and account management processes, leading to account takeover (ATO) risks. One researcher discovered an insecure email verification flow in a self-hosted program, where changing the account email and then using a previously issued password reset link allowed an attacker to reset the password for the new email address, effectively taking over the account. This flaw was reported and resulted in a medium-severity bug bounty, demonstrating the real-world impact of improper session and token management during email changes. Another case involved a fintech startup where password reset emails were sent over HTTP instead of HTTPS, exposing the reset token to interception by attackers on insecure networks. This seemingly minor oversight could allow attackers to hijack any account by capturing the token, underscoring the importance of secure transmission for authentication links. Additionally, a common SSO misconfiguration was identified, where the identity provider failed to verify email ownership, enabling users from one organization to access data from another simply by sharing the same email address. This logic flaw in SSO implementation could result in complete account compromise across organizational boundaries. The technical details of these attacks reveal that vulnerabilities often stem from overlooked aspects of authentication flows, such as improper invalidation of tokens, insecure communication channels, and misconfigured trust relationships in SSO. The impact of these flaws is significant, as they can lead to unauthorized access, data breaches, and loss of user trust. Security researchers emphasize the need for rigorous testing of authentication and authorization mechanisms, including manual testing and review of edge cases like email changes and SSO integrations. The response from affected organizations has included prompt acknowledgment and remediation of reported issues, with some awarding bounties to the researchers. These incidents serve as a reminder that even well-established security controls like 2FA, SSO, and HTTPS can be undermined by implementation errors. Organizations are advised to review their authentication workflows, ensure all sensitive links are transmitted securely, and validate email ownership at every step. The findings also highlight the value of bug bounty programs and independent security research in uncovering and addressing critical vulnerabilities before they can be exploited by malicious actors.
Jul 1, 2026
Multiple security researchers have documented the discovery and exploitation of critical vulnerabilities in web applications that can lead to full account takeover, data leakage, and privilege escalation. One researcher identified a business logic flaw involving inconsistent validation between client-side and server-side checks, which allowed unauthorized access to premium account features without payment. Another case involved a password change functionality that, due to improper implementation, enabled attackers to compromise user accounts entirely, with a CVSS score of 8.3 highlighting its severity. Blind XSS vulnerabilities were also reported, where payloads injected into user-facing forms were later triggered in privileged internal dashboards, resulting in session hijacking and potential compromise of sensitive systems. A critical OAuth misconfiguration was found, where manipulation of the redirect_uri parameter enabled attackers to steal JWT tokens, granting them unauthorized access to user accounts. Misconfigured Cross-Origin Resource Sharing (CORS) headers were exploited to escalate privileges, allowing attackers to become administrators and exfiltrate sensitive data across domains. Another researcher demonstrated how error messages and exposed API endpoints could be leveraged to enumerate and access sensitive backend systems, increasing the attack surface. The exposure and leakage of JWT tokens in server responses were shown to facilitate privilege escalation and impersonation of any user on the platform. Cache poisoning attacks against CDN infrastructure were also detailed, where improper cache key handling resulted in users receiving cached responses containing other users' private data, leading to widespread session hijacking. These incidents underscore the importance of secure implementation of authentication, authorization, and session management mechanisms. The vulnerabilities described were discovered through a combination of manual testing, creative payload injection, and analysis of application logic rather than automated scanning. Proof-of-concept exploits were provided for several of the vulnerabilities, demonstrating the ease with which attackers could compromise accounts or escalate privileges. The affected applications often failed to implement proper input validation, secure token handling, and least-privilege access controls. In several cases, the vulnerabilities were reported responsibly to the affected organizations, resulting in remediation and, in some instances, significant bug bounty rewards. The reports highlight the ongoing risk posed by business logic flaws, misconfigurations, and insufficient security controls in modern web applications. Security teams are advised to conduct thorough code reviews, implement robust validation on both client and server sides, and regularly audit authentication and authorization flows. The findings also emphasize the need for continuous monitoring and testing of production systems to detect and remediate such vulnerabilities before they can be exploited by malicious actors. Overall, these real-world cases provide actionable insights for organizations seeking to strengthen their web application security posture.
Jul 12, 2026
Praetorian reported an attack chain in which adversaries combine two seemingly lower-severity weaknesses—**abusable public-facing email/newsletter API endpoints** and **verbose error handling that leaks OAuth 2.0 bearer tokens**—to achieve high-impact compromise. In the first step, attackers manipulate unauthenticated JSON parameters (e.g., recipient, subject, body) in business-logic-driven endpoints (such as newsletter signups/contact forms/password resets) to force an organization’s own infrastructure to send attacker-crafted emails. Because the messages are sent by authorized systems, they *pass* SPF/DKIM/DMARC checks and are more likely to land in users’ primary inboxes, effectively turning trusted infrastructure into a phishing delivery mechanism. The second step escalates impact when malformed requests (including incomplete or invalid JSON) trigger debugging responses that return stack traces and inadvertently expose **OAuth access tokens** used by internal services. With stolen tokens—often usable against **Microsoft Graph** depending on configured scopes—attackers can access Microsoft 365 resources without needing user credentials, potentially enabling broad tenant compromise. The reporting emphasizes that the protocols (SPF/DMARC) are not “broken”; rather, attackers are exploiting legitimate sending paths and poor error hygiene, illustrating how **vulnerability chaining** can turn medium/low issues into a critical compromise path.
Jun 29, 2026