[OAUTH-WG] Re: Call for adoption: draft-wuertele-oauth-security-topics-update-02 (Ends 2025-10-17)

Fri, 17 Oct 2025 06:35:26 -0700

Hi all,

 

A bit of background on the document:

https://datatracker.ietf.org/doc/html/draft-wuertele-oauth-security-topics-update

 

 

We recently discussed this in the WG Interim Meeting on Sept 29 (Slides [1], Video [2], Minutes [3]), following earlier discussions at IETF 122 & 123. The draft currently documents three attacks that can lead to unauthorized access/account takeover:

 

  • Section 2.1 “Audience Injection Attacks”. A security-focused description of the attack, as a follow-up on several spec updates, including OAuth RFC7523bis [4], OIDC-core [5] and FAPI [6]. Details can be found in the preprint [7] and disclosure [8].
  • Section 2.2 “Cross-tool OAuth Account Takeover”. A generalization of mix-up attack variants with defenses tailored for emerging ecosystems. We found 20+ major vendors vulnerable (e.g., Google, Microsoft, Amazon, Samsung). Microsoft, for example, “rearchitected the connector ecosystem” [9] when addressing the CVSS 9.6/10 CVE [10]. Further details of the research are in [11] [12].
  • Section 2.3 “Cross-user OAuth Session Fixation”. A new class of attack against authorization code grant, when an auth session can be fixated via a URL to hijack authorizations. Similar to above, 35+ vendors found vulnerable. Details available in [12] [13].

 

 

Regarding the document management process (if adopted), the current rough “consensus” is to eventually have it coexist with (rather than replace) the published Security BCP - RFC9700 [14], under BCP 240:

https://datatracker.ietf.org/doc/bcp240/

 

 

Thank you,
Kaixuan Luo
co-author of the draft

 

 

[1] https://datatracker.ietf.org/meeting/interim-2025-oauth-08/materials/slides-interim-2025-oauth-08-sessa-ietf-interim-updating-the-security-bcp-00

[2] https://youtu.be/OlWq0aFn6Fo

[3] https://datatracker.ietf.org/meeting/interim-2025-oauth-08/materials/minutes-interim-2025-oauth-08-202509291700-00

 

[4] https://datatracker.ietf.org/doc/draft-ietf-oauth-rfc7523bis/

[5] https://openid.net/specs/openid-connect-core-1_0-36.html

[6] https://bitbucket.org/openid/fapi/pull-requests/522/

[7] https://eprint.iacr.org/2025/629

[8] https://openid.net/notice-of-a-security-vulnerability/

 

[9] https://youtu.be/0Bw2YCDypUY?t=2743

[10] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36019

[11] https://www.usenix.org/conference/usenixsecurity25/presentation/luo-kaixuan

[12] https://www.blackhat.com/us-25/briefings/schedule/#back-to-the-future-hacking-and-securing-connection-based-oauth-architectures-in-agentic-ai-and-integration-platforms-44686

[13] https://www.blackhat.com/us-24/briefings/schedule/#one-hack-to-rule-them-all-pervasive-account-takeovers-in-integration-platforms-for-workflow-automation-virtual-voice-assistant-iot-38-llm-services-38994

 

[14] https://datatracker.ietf.org/doc/html/rfc9700

 

 

 

On 2025/10/3, 19:01, "Rifaat Shekh-Yusef via Datatracker" <[email protected]> wrote:

 

Subject: Call for adoption: draft-wuertele-oauth-security-topics-update-02

(Ends 2025-10-17)

 

This message starts a 2-week Call for Adoption for this document.

 

Abstract:

   This document updates the set of best current security practices for

   OAuth 2.0 by extending the security advice given in RFC 6749, RFC

   6750, and RFC 9700, to cover new threats that have been discovered

   since the former documents have been published.

 

File can be retrieved from:

 

Please reply to this message keeping [email protected] in copy by indicating

whether you support or not the adoption of this draft as a WG document.

Comments to motivate your preference are highly appreciated.

 

Authors, and WG participants in general, are reminded of the Intellectual

Property Rights (IPR) disclosure obligations described in BCP 79 [2].

Appropriate IPR disclosures required for full conformance with the provisions

of BCP 78 [1] and BCP 79 [2] must be filed, if you are aware of any.

Sanctions available for application to violators of IETF IPR Policy can be

found at [3].

 

Thank you.

 

 

 

_______________________________________________

OAuth mailing list -- [email protected]

To unsubscribe send an email to [email protected]

 

_______________________________________________
OAuth mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to