Back to the Future: Hacking and Securing Connection-based OAuth Architectures

Overview: Wing Lau and Kaishun present a comprehensive security evaluation of the emerging "OAuth-as-a-Service" (OaaS) paradigm and connection-based OAuth architectures across Agentic AI ecosystems, integration platforms, and Model Context Protocol (MCP) implementations. To insulate third-party AI agent developers from OAuth token management complexities, modern platforms delegate token lifecycles to centralized token managers using "connection IDs." However, the researchers reveal that decoupling the traditional OAuth client role across two independent entities breaks foundational security assumptions in RFC 6749, resurrecting classic web vulnerabilities—including session fixation, open redirect, and confused deputy flaws—across seven leading agentic AI vendors.

Key Topics: - Architecture of OAuth-as-a-Service (OaaS) and Connection-based OAuth in Agentic AI and MCP - Session fixation attacks via decoupled connection handles and authorization session mismatch - Post-redirect implementation flaws and chained stored XSS exploitation (Microsoft Power Apps / Outlook exfiltration) - Confused deputy attacks: Client ID confusion and cross-agent Cross-App Account Takeover (COAT) in Microsoft Copilot Studio

Technical Details: In connection-based OAuth architectures, an AI agent initiates an authorization request to a centralized token manager, which creates an empty connection record tracking a three-element tuple (tool, agent, user) and returns an authorization URL. When the user completes the OAuth dance, the token manager exchanges the authorization code and stores the access token under the connection ID. Because the token manager operates independently of the agent's user session state, an attacker can initiate an authorization flow, obtain a valid OAuth URL tied to an attacker-owned connection handle, and deliver the link to a victim. Because enterprise users frequently maintain pre-authenticated active SaaS sessions (e.g., Dropbox or Microsoft 365), the victim automatically completes authorization, linking their sensitive tool token to the attacker's connection ID—achieving full session fixation and account takeover (affecting five major vendors).

To remediate session fixation, platforms must enforce user identity consistency between flow initiation and completion via a "post-redirect" back to the agent backend. However, passing this callback destination as a front-end parameter introduced severe Open Redirect vulnerabilities. For example, in Microsoft's token manager, post-redirect URIs were evaluated using loose wildcard matching. The researchers discovered a stored cross-site scripting (XSS) vulnerability on ideas.powerapps.com (a Microsoft Power Apps community forum). By pointing the OAuth post-redirect to the vulnerable forum page, an attacker lured victims into clicking the link, executed JavaScript to intercept the victim's authorization code, exchanged it for an access token, and exfiltrated sensitive emails from the victim's Outlook mailbox. Additionally, the authors exposed two confused deputy classes: "Client ID Confusion," where token managers share pre-registered client IDs across multiple agents, causing consent granted for a benign agent to be inherited silently by a malicious agent; and cross-agent Cross-App Account Takeover (COAT) in Microsoft Copilot Studio, where attackers configure rogue identity providers to bypass tenant-isolation boundaries and hijack access to victim copilots.

Key Takeaways: Splitting the OAuth client role between third-party agent applications and centralized token managers creates critical architectural blind spots that invalidate standard OAuth security models. Token managers must strictly verify user identity consistency across the entire authorization lifecycle using securely pre-configured backend post-redirects rather than dynamic front-end parameters, or employ out-of-band validation mechanisms (such as 6-digit PIN codes) when operating over instant messaging channels (Slack, Teams). Finally, platforms must avoid sharing global OAuth client IDs across multiple agents and require each agent to register isolated credentials to prevent unauthorized cross-agent permission inheritance.

(AI summary — Gemini Flash)