# Over-consented OAuth app token abuse

Vendor or legacy OAuth apps holding tenant-wide admin consent that low-privilege accounts can mint tokens for

_Area: Web authentication and account takeover. Seen in 2 disclosed reports; latest 2026-10-26. Updated 2026-11-02._

## How it works
OAuth app credentials (client secrets, certificates) authenticate as the application, not a user. When an app holds tenant-wide admin-consented scopes, any principal that can read or mint that credential gets directory write access across the whole tenant — and, for multi-tenant apps, across every tenant that consented. The broken assumption is that "the vendor app is trusted, so its tokens are safe." Trust in the app's identity is not trust in whoever holds its secret. A low-privilege or legacy account that can manage app secrets, or a dormant integration credential nobody decommissioned, becomes a skeleton key [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-connectwise-attack-ai.md)[E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-klue-breach-investigation.md)[E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md).

## Where it shows up
- Service principals with tenant-wide admin consent: `Directory.ReadWrite.All`, `RoleManagement.ReadWrite.Directory`, `Application.ReadWrite.All`, `AppRoleAssignment.ReadWrite.All`, `full_access_as_app` [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md).
- Multi-tenant vendor apps whose single credential authenticates into many downstream tenants [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-connectwise-attack-ai.md).
- Integration credentials from abandoned prototypes still active [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-klue-breach-investigation.md).
- Legacy/test tenants without MFA whose accounts can manage OAuth app secrets [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md).
- App-only Graph calls that add secrets/certs or assign roles to themselves [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-connectwise-attack-ai.md).

## How to review
For each service principal, ask: what scopes does it hold, who can mint its credential, and does it need directory-write? The invariant: no app credential reachable by a low-privilege, legacy, or dormant account may hold tenant-wide write consent. Check that app-secret management is itself privileged, that test tenants are not federated/consented into production, and that vendor apps are scoped to least privilege. Flag any app that can grant itself or a sibling principal a role [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-connectwise-attack-ai.md)[E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md).

## How finders spotted it
- Huntress read Entra sign-in and directory audit logs and saw ascending tenant-ID ordering at fixed cadence with identical User-Agent (a script loop), a 100-request/10s burst with identical failures (thread pool), and tooling mutating within 55s of a failure to add backoff — operator adaptation visible in logs [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-connectwise-attack-ai.md).
- They baselined each vendor app's expected User-Agent (e.g. kiota-dotnet), source range and cadence, then alerted when a vendor principal granted itself Global Admin [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-connectwise-attack-ai.md).
- Klue noticed anomalous behavior in an integration-connecting system, then unusual outbound connections to attacker IPs; Huntress confirmed downstream impact by pulling Salesforce/Gong query logs and spotting telltale User-Agents (5238, blank, Python-urllib) against the v59.0 query endpoint [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-klue-breach-investigation.md).
- Wiz reconstructed the chain from Microsoft's disclosure, inferring the exact Graph permissions needed at each step from the stated capabilities [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md).

## Variants seen
- Stolen multi-tenant vendor app credential replayed across ~1,000 M365 tenants [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-connectwise-attack-ai.md).
- Dormant prototype integration credential used to push token-stealing code and harvest customer OAuth tokens [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-klue-breach-investigation.md).
- Legacy MFA-less test tenant + over-consented test app chained into corporate tenant [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md).

## Impact and severity
Critical. App-only tokens gave directory write, credential planting, and self-granted Global Admin within hours across ~1,000–2,250 tenants [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-connectwise-attack-ai.md). One upstream compromise fanned out to many downstream orgs via stored OAuth tokens, enabling CRM data theft and extortion [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-klue-breach-investigation.md). Test-tenant compromise led to Global Admin and tenant-wide mailbox access [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md). Impact scales with consent breadth and number of trusting tenants.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **ConnectWise Cloud Backup** (version not stated): AI, Scripts, Operator: Inside the ConnectWise Attack. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-connectwise-attack-ai.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-connectwise-attack-ai.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-klue-breach-investigation.md
- E3: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md