Microsoft nOAuth Flaw Still Exposes SaaS Apps Two Years After Discovery – Source: www.infosecurity-magazine.com

A critical vulnerability in Microsoft’s Entra ID still exposes a wide range of enterprise applications two years after it was discovered.

Semperis, an identity security provider, shared new findings on this threat on June 25 at the TROOPERS25 conference in Heidelberg, Germany.

The report showed that at least 15,000 software-as-a-service (SaaS) applications are likely vulnerable to nOAuth, a severe authentication flaw in Microsoft’s Entra ID that can lead to account takeovers and data exfiltration.

The nOAuth Vulnerability Explained

Detected in June 2023 by Descope through cross-tenant testing, nOAuth is an authentication implementation flaw that can affect Microsoft Azure AD multi-tenant Open Authorization (OAuth) applications. OAuth is an open, token-based authorization framework that allows users to grant access to their private resources on one application to another application without giving away their identity details.

OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0, allowing applications to verify users’ identities and obtain basic profile information. The protocol uses JSON Web Tokens (JWT) to transmit this information between parties securely.

The flaw exploits Entra ID app configurations that permit unverified email claims as user identifiers, a known anti-pattern per OpenID Connect standards. In these scenarios, attackers need only an Entra tenant and the target’s email address to assume control of the victim’s SaaS account. 

Additionally, traditional safeguards such as multifactor authentication (MFA), conditional access and Zero Trust policies are unable to protect against this vulnerability.

Undetected by SaaS vendors

Semperis has found that two years after the discovery of nOAuth, many SaaS applications were still vulnerable to the flaw.

The company estimated that these vulnerable apps represent at least 10% of the total of SaaS applications in use, which it assessed to be at over 150,000.

This means that at least 15,000 enterprise SaaS applications are still vulnerable to nOAuth in June 2025.

This is because the vulnerability “continues to go undetected by SaaS vendors, who may not even know what to look for and it is nearly impossible for enterprise customers to defend against, allowing attackers to take over accounts and exfiltrate data,” the company explained.

Eric Woodruff, Semperis’ Chief Identity Architect, presented the company’s findings at TROOPERS25. He ranked this vulnerability as “severe” because the attack is low complexity and is impossible to defend against. 

He said: “It’s easy for well-meaning developers to follow insecure patterns without realizing it and in many cases, they don’t even know what to look for. Meanwhile, customers are left with no way to detect or stop the attack, making this an especially dangerous and persistent threat.”

Protecting Against nOAuth Vulnerabilities

While traditional vulnerability mitigation measures do not work against nOAuth, Semperis provided some recommendations to mitigate the threats. These included:

• SaaS vendors should follow Microsoft’s recommendations to prevent nOAuth abuse
• Developers should implement the necessary fixes to protect their customers
• Organizations should have deep log correlation across both Entra ID and the SaaS platform to detect nOAuth abuse