[Stanley]

nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After D

New research has uncovered continued risk from a known security weakness in Microsoft's Entra ID, potentially enabling malicious actors to achieve account takeovers in susceptible software-as-a-service (SaaS) applications.
Identity security company Semperis, in an analysis of 104 SaaS applications, found nine of them to be vulnerable to Entra ID cross-tenant nOAuth abuse.
First disclosed by

https://thehackernews.com/2025/06/noauth...-9-of.html

[The Pact]

Researchers looked at over a hundred popular business apps and found that nine of them are still vulnerable to a flaw in Microsoft’s Entra ID system. That flaw could let someone sneak in and take over an account, pretending to be someone they’re not.

What’s especially annoying is that this issue was already disclosed. It’s not new. But the fact that it’s still being exploited means some companies haven’t patched it or didn’t realize they were exposed in the first place.

[Fish]

nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After D

New research has uncovered continued risk from a known security weakness in Microsoft's Entra ID, potentially enabling malicious actors to achieve account takeovers in susceptible software-as-a-service (SaaS) applications.
Identity security company Semperis, in an analysis of 104 SaaS applications, found nine of them to be vulnerable to Entra ID cross-tenant nOAuth abuse.
First disclosed by

https://thehackernews.com/2025/06/noauth...-9-of.html

9/104 is a pretty significant chunk. Once you have the 9, imagine the damage that can be done

[DAL-SHA]

Two years later and 9% of Entra SaaS apps are still rocking that nOAuth vuln? That’s like leaving your car unlocked in a sketchy neighborhood—inviting trouble and wondering why your stuff’s gone. Time for a serious cleanup!🙄😒