+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: News and Happenings (https://hackforums.net/forumdisplay.php?fid=89)
+---- Thread: nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After D (/showthread.php?tid=6302295)
nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After D - Stanley - Jul 5, 2025
nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After D
New research has uncovered continued risk from a known security weakness in Microsoft's Entra ID, potentially enabling malicious actors to achieve account takeovers in susceptible software-as-a-service (SaaS) applications.
Identity security company Semperis, in an analysis of 104 SaaS applications, found nine of them to be vulnerable to Entra ID cross-tenant nOAuth abuse.
First disclosed by
https://thehackernews.com/2025/06/noauth-vulnerability-still-affects-9-of.html
RE: nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After D - The Pact - Oct 2, 2025
Researchers looked at over a hundred popular business apps and found that nine of them are still vulnerable to a flaw in Microsoft’s Entra ID system. That flaw could let someone sneak in and take over an account, pretending to be someone they’re not.
What’s especially annoying is that this issue was already disclosed. It’s not new. But the fact that it’s still being exploited means some companies haven’t patched it or didn’t realize they were exposed in the first place.
RE: nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After D - Fish - Oct 7, 2025
(Jul 5, 2025 08:35 PM)Stanley Wrote: nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After D9/104 is a pretty significant chunk. Once you have the 9, imagine the damage that can be done
New research has uncovered continued risk from a known security weakness in Microsoft's Entra ID, potentially enabling malicious actors to achieve account takeovers in susceptible software-as-a-service (SaaS) applications.
Identity security company Semperis, in an analysis of 104 SaaS applications, found nine of them to be vulnerable to Entra ID cross-tenant nOAuth abuse.
First disclosed by
https://thehackernews.com/2025/06/noauth-vulnerability-still-affects-9-of.html
RE: nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After D - DAL-SHA - Oct 7, 2025
Two years later and 9% of Entra SaaS apps are still rocking that nOAuth vuln? That’s like leaving your car unlocked in a sketchy neighborhood—inviting trouble and wondering why your stuff’s gone. Time for a serious cleanup!🙄😒