Topic
A security discipline covering vulnerabilities and hardening practices in OAuth 2.0 and OpenID Connect authorization flows and token handling.
Spring Security 7.1 no longer applies DPoP verification on resource servers automatically, so upgraded apps stop enforcing it until they add .dPoP(). InfoQ's walk-through calls the failure silent and the rest of the upgrade a version bump.
Reality
MCP Python SDK maintainers fixed a flaw rated up to 7.5 that lets malicious servers steal OAuth client secrets, in versions 1.30.0 and 2.2.0. Two of the affected providers stay exposed after upgrading until the calling code passes issuer=.
Reality
F5 disclosed CVE-2026-94127 on September 22 with hotfixes and evidence of exploitation. It is a data plane heap overflow, so a locked-down management interface still leaves the system exploitable, and federal agencies had until September 25.
Perspective Coverage
6 publishersReality
The OAuth device authorization grant was built for smart TVs and printers. Kits such as EvilTokens use it to get victims to approve an attacker's sign-in on a page that really is Microsoft's, MFA included.
Reality
Cognito validates the redirect target by matching it against the app client's allowed callback list, so a development entry nobody removed is a valid destination for an authorization code, or for the tokens themselves where implicit grant is still on.
Reality
One authentik CVE covers a token endpoint accepting a missing code_verifier; another, six months later, covers an authorization endpoint accepting a missing code_challenge. OpenAM's equivalent check ships switched off.
Reality