Hackers use stolen OAuth access tokens to breach dozens of organization’s internal systems
A VentureBeat article from April 2022 reports on attackers using stolen OAuth tokens from tools like Heroku and Travis to breach dozens of organizations. Casey Ellis, founder and CTO of Bugcrowd, is quoted warning that cloud convenience makes failing to audit, monitor, or expire OAuth keys easier.
Source description, as published
Organizations using tools like Heroku and Travis that generate OAuth user tokens should evaluate the security risks raised by those tools.