#OAuth
All CosmicBytez Labs articles tagged #OAuth, across news, security advisories, how-to guides, and projects.
- News
Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
Amazon blocked Meta's Muse for not disclosing it was a bot, as personal AI agents like Instinct and OpenClaw gain unmanaged access to corporate SaaS logins.
- News
OAuth Grants Pile Up Faster Than You Can Review Them — Here's How to Keep Up
OAuth grants are piling up faster than security teams can review them, and the Klue breach shows how one forgotten credential exposed data at dozens of firms.
- Security
CVE-2026-97720: Apache Impala JWT/OAuth Authentication Bypass
Apache Impala executor webservers accept any valid JWT without checking its signature, letting attackers bypass JWT/OAuth auth entirely.
- News
F5 Patches BIG-IP APM Zero-Day Flaw Exploited in RCE Attacks
F5 patched CVE-2026-94127, a CVSS 9.8 BIG-IP APM zero-day already exploited for unauthenticated RCE; CISA added it to its KEV catalog.
- News
Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users
"Twitch Enhanced Viewer | JeetBot" forwarded OAuth tokens in cleartext to a Russian bot service's proxy, exposing roughly 31,000 users.
- News
Twitch Extension With 30K Installs Exposes Users' OAuth Tokens
Twitch Enhanced Viewer | JeetBot, installed 30,000+ times, quietly forwarded users' OAuth tokens to a Russian commercial bot service, Socket found.
- Security
TypeBot OAuth Credential Takeover via Low-Privilege Collaborator
TypeBot versions before 3.17.0 allow a read-only collaborator to extract and overwrite workspace OAuth credentials, enabling full account takeover.
- Security
CVE-2026-45689: Rocket.Chat OAuth Token Hijack via MongoDB Operator Injection (CVSS 9.1)
Critical pre-authentication vulnerability in Rocket.Chat allows any unauthenticated network attacker to obtain a valid OAuth access token for an arbitrary...
- News
Scope of Salesforce Attacks Expands as Icarus Leaks Stolen Data
More victims have surfaced after attackers breached application vendor Klue and abused its OAuth tokens to access customers' Salesforce environments. The...
- Newsletter
June 23 Digest: FortiBleed, Klue/Salesforce Supply Chain, Squidbleed, GitHub Actions Fix
A Russian IAB harvests 110M credentials from FortiGate firewalls; the Icarus group drains hundreds of Salesforce orgs via Klue OAuth tokens; a 29-year-old...
- News
Forget Data Leakage: Shadow AI's Real Threat Is Access Control
The original shadow AI concern — employees pasting sensitive data into public tools — has been overtaken by a more dangerous problem: unsanctioned AI apps...
- News
Klue OAuth Breach Victim List Grows as Icarus Hackers Claim Attack
Market intelligence platform Klue has confirmed attackers stole OAuth tokens connected to customers' Salesforce environments, as the Icarus extortion...
- News
Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data
Salesforce has disabled the Klue Battlecards app integration following a security incident in which attackers abused OAuth tokens to access customer CRM...
- News
Klue OAuth Breach Linked to 'Icarus' Salesforce Data Theft Attacks
Market intelligence platform Klue suffered an OAuth breach that enabled the 'Icarus' threat actors to steal Salesforce CRM data from multiple...
- News
Salesforce Data Thefts Continue via Klue App Compromise
Klue's Battlecards competitive intelligence application has become the third integrated app compromised in the ongoing Icarus campaign targeting...
- Security
WordPress Form Notify Plugin Auth Bypass via LINE OAuth
The Form Notify plugin for WordPress is vulnerable to authentication bypass in versions up to and including 1.1.10. Attackers can manipulate...
- News
ConsentFix v3 Automates Azure OAuth Abuse With Mass
A new iteration of the ConsentFix attack toolkit has surfaced on cybercriminal forums, adding automation and scaling capabilities to OAuth consent...
- News
Learning from the Vercel Breach: Shadow AI and OAuth Sprawl
The Vercel breach, traced to a compromised third-party AI tool with OAuth access, illustrates how Shadow AI adoption and unchecked OAuth integrations are...
- News
Vercel Employee's AI Tool Access Led to Data Breach
Stolen OAuth tokens from a compromised employee AI tool enabled attackers to pivot into Vercel's internal systems. Security researchers warn that...
- News
Device Code Phishing Attacks Surge 37x as New Kits Spread
Device code phishing attacks abusing the OAuth 2.0 Device Authorization Grant flow have exploded 37-fold in 2026 as ready-made phishing kits proliferate...
- News
Shadow AI in SaaS: How Hidden AI Agents Are Enabling
A new Grip Security report analyzing 23,000 SaaS environments finds 100% of companies operate shadow AI they cannot see or control — with a 490% spike in...
- Security
Critical Auth Bypass in Tutor LMS Pro Exposes 30,000+
The Tutor LMS Pro WordPress plugin's Social Login addon fails to verify OAuth token email matches the login request, allowing unauthenticated attackers to...