Open Nav
Sign Up

nOAuth – Microsoft OAuth Misconfiguration can result in a full account takeover.

OPInnovate Research

August 1, 2023

A significant flaw known as nOAuth has come to light, discovered by the diligent security team at Descope. This flaw, found in Microsoft Azure AD OAuth applications, could potentially lead to a full account takeover. This post is dedicated to exploring this issue, its implications, and the steps you can take to mitigate its impact.

What is nOAuth?

nOAuth is a term coined by the Descope security team, who first uncovered this configuration issue in Microsoft Azure AD multi-tenant OAuth applications. The flaw lies in the usage of the mutable and unverified “email” claim in Microsoft Azure AD as an identifier, a practice that most Identity Providers (IdPs) advise against.

The Potential Damage of nOAuth

The nOAuth flaw, can be exploited by an attacker who changes the email attribute under “Contact Information” in the Azure AD account. This allows them to control the “email” claim in the returned identity JWT, and consequently, use “Log in with Microsoft” with a vulnerable app and a specially crafted “victim” user. The result? A complete account takeover.

Microsoft’s Response to nOAuth

In response to the discovery, Microsoft has taken steps to address the nOAuth issue. They have refactored their documentation, providing stronger guidance on claim verification. Additionally, they have introduced two new claims to mitigate cases where nOAuth is used for cross-tenant spoofing. These features will enable apps to verify whether an email claim contains a domain-verified email address and mitigate email claims when the email domain is unverified.

Steps to Mitigate the nOAuth Issue

Following Microsoft’s advice in their claims validation documentation, “upn”, “email”, “preferred_username” and other claims should not be used to make authentication or authorization decisions. The claim that should be used as the unique identifier for the user is the “sub” (Subject) claim.

If you wish to continue merging user accounts, it’s important to validate the email address provided by Microsoft with a magic link or similar secure means. This ensures that the email is controlled by the real account holder. You can also use the two new claims introduced by Microsoft to explicitly indicate whether an email claim is from a domain-verified email and redact the email claim if needed.

Conclusion

The discovery of the nOAuth issue underscores the complexity of authentication and authorization, and the potential vulnerabilities that can arise. It serves as a reminder of the importance of regular deep security reviews of authentication implementations. If you need help identifying whether your app is vulnerable to nOAuth and/or implementing a fix, consider reaching out OP Innovate’s cybersecurity experts.

Resources highlights

CVE-2025-55177: WhatsApp Authorization Flaw Exploited in Zero-Click Spyware Chain

WhatsApp has patched CVE-2025-55177, an authorization flaw in its linked-device synchronization feature that was exploited in the wild.  While Meta originally rated it medium severity,…

Read more >

CVE-2025-55177

Docker Issues Patch for Critical Exploit in Docker Desktop: CVE-2025-9074

On August 20, 2025, Docker released an urgent patch for CVE-2025-9074, a critical Server-Side Request Forgery (SSRF) vulnerability (CVSS 9.3) affecting Docker Desktop for Windows…

Read more >

CVE-2025-9074

CVE-2025-48384: Git Submodule Path Flaw Exploited in the Wild

CVE-2025-48384 is a client-side Git vulnerability that lets a malicious repository abuse a mismatch in how Git reads vs. writes configuration values containing a trailing…

Read more >

CVE-2025-48384

CVE-2025-43300: Apple ImageIO Zero-Day Exploited in Targeted Attacks

Apple patched CVE-2025-43300, a zero-day in the ImageIO framework used system-wide to read/write many image formats. Opening or previewing a malicious image can corrupt memory…

Read more >

CVE-2025-43300

CVE-2025-57790: Commvault Path Traversal Vulnerability Leads to RCE

On August 19th, Commvault published advisory CV_2025_08_2 for a newly-discovered path traversal flaw in the Web Server component that allows remote attackers to perform unauthorized…

Read more >

CVE-2025-57790

CVE-2025-20265: Cisco Secure Firewall Management Center (FMC) RADIUS Pre-Auth RCE

A critical (CVSS 10.0)  input-handling flaw in the RADIUS authentication subsystem of Cisco Secure Firewall Management Center (FMC), tracked as CVE-2025-20265 allows unauthenticated remote code…

Read more >

CVE-2025-20265
Under Cyber Attack?

Fill out the form and we will contact you immediately.