Hackers are using OAuth as a loophole to retain access to user accounts. Password resets won’t help, and even multi‑factor authentication can be evaded.

Malicious OAuth apps can hide inside Microsoft 365 tenants. Huntress Labs' Cazadora script helps uncover rogue apps before ...

Heroku has explained why it emailed users with a sudden password reset warning earlier this week, and how it was due to the theft of OAuth tokens from GitHub. "[Our investigation] revealed that the ...

Applications are no longer allowed to store your password. If you change your password, the applications will continue to work. Some applications you have been using may require you to reauthorize ...

Social media supersite Facebook has fixed a vulnerability that could have allowed a hacker to access a user’s account simply by getting them to click through to a specially crafted website. The flaw ...