Tag
Authorizer Unvalidated Redirect Vulnerability Allows OAuth2 Token Theft
1 rule 2 TTPs 1 IOCAn unvalidated redirect vulnerability, CVE-2026-54072, in the Authorizer `/authorize` endpoint allows an unauthenticated attacker to steal OAuth2 access, ID, and refresh tokens by crafting a malicious URL with an attacker-controlled `redirect_uri` to which the application redirects a logged-in user, exposing their tokens.
Entra ID OAuth Application Redirect URI Modified
2 rules 2 TTPsAdversaries are modifying OAuth application redirect URIs (ReplyUrls) in Microsoft Entra ID to intercept OAuth authorization codes and steal tokens, granting unauthorized access without new application registration or user consent.
Process Created with an Elevated Token via Token Theft
2 rules 1 TTPThis rule detects the creation of a process running as SYSTEM while impersonating the token context of a Windows core binary, which adversaries may leverage to escalate privileges and bypass access controls through token theft.
Cinny Access Token Disclosure via Malicious Emoji Pack
3 rules 1 TTPA remote authenticated attacker who shares a room with a victim can steal their Matrix access token by injecting a malicious emote pack, exploiting improper URL validation and service worker behavior in Cinny versions prior to 4.10.3.
Privilege Escalation via Windows Token Theft
2 rules 1 TTPAn adversary may create a new process with a different token to escalate privileges and bypass access controls by creating a process running as SYSTEM and impersonating a Windows core binary.