Identity-and-Access-Management

A vulnerability in the Pocket ID OpenID Connect (OIDC) `createTokenFromRefreshToken` function allows refresh tokens to bypass critical authorization controls, enabling threat actors to maintain perpetual access to client applications even after a user revokes authorization, an administrator disables the user account, or a user is removed from an allowed group.

This brief identifies successful logins to the AWS Management Console by standard IAM users without Multi-Factor Authentication (MFA). It focuses on the first observed occurrence within a 7-day history window for each user. An adversary who obtains a user's password can gain access if MFA is not enforced, representing a significant initial access vector. This event signals a critical posture gap that allows adversaries to achieve initial access using compromised credentials, leading to potential privilege escalation, data exfiltration, or resource deployment.

Adversaries leverage a compromised AWS EC2 instance's assumed IAM role to create new, unauthorized IAM users, establishing persistence within the AWS environment by granting themselves persistent access even after the initial compromise is remediated.