nOAuth Vulnerability Persists in 9% of Microsoft Entra SaaS Applications Two Years After Initial Identification
June 25, 2025
Recent findings have revealed that a previously identified security vulnerability within Microsoft Entra ID continues to pose risks for certain software-as-a-service (SaaS) applications, potentially allowing malicious entities to exploit these weaknesses and gain unauthorized access to accounts. Research conducted by the identity security firm Semperis examined 104 SaaS applications, discovering that nine of them remain vulnerable to cross-tenant nOAuth exploitation.
First highlighted by Descope in June 2023, nOAuth represents an oversight in the implementation of the OpenID Connect (OIDC) authentication framework, which serves as a crucial layer on top of the OAuth protocol for user identification. The flaw allows attackers to manipulate the mail attribute associated with an Entra ID account, substituting it with that of a targeted victim. Consequently, this enables malicious actors to utilize the application’s “Log in with Microsoft” feature to illegally access and commandeer accounts.
The simplicity of this attack vector is alarming; it capitalizes on the fact that Entra ID allows users to connect accounts with unverified email addresses. This loophole presents an opportunity for user impersonation, a scenario that could lead to severe security breaches and unauthorized data access. Given the widespread adoption of SaaS solutions, the impact of such breaches can extend beyond individual accounts, potentially affecting the integrity of an organization’s entire digital infrastructure.
In terms of targeted demographics, the victims of this vulnerability are primarily users of the affected SaaS applications, which may span various sectors, including finance, healthcare, and technology. The persistence of this vulnerability underscores a critical concern for organizations relying on Microsoft Entra ID for identity and access management.
From a cybersecurity perspective, the tactics associated with this form of attack can be mapped to the MITRE ATT&CK framework, providing insights into the methods adversaries might use. Initial access through credential manipulation and persistence techniques via account hijacking are significant areas of concern. Once an attacker gains foothold, they may escalate privileges, allowing them to conduct further unauthorized actions within compromised environments.
Business owners and IT security professionals must remain vigilant and proactive in addressing these vulnerabilities. Regular assessments of existing security measures and timely updates in response to disclosed vulnerabilities are essential strategies for safeguarding sensitive data and protecting against potential exploits.
As investigations progress and remedial measures are put in place, it remains paramount for organizations to stay informed about emerging threats. Continued awareness can reduce the likelihood of falling victim to such vulnerabilities and stregthen overall cybersecurity defenses in an increasingly complex digital landscape.
