---
title: Tip: OAuth phishing skips your MFA and survives password resets. Turn off user app consent, audit redirect URIs and lock down device-code sign-in | ctxsec
url: https://ctxsec.com/items/tip-unit42-oauth-consent-redirect-audit
description: ""
status: "guidance from Unit 42 research (Oct 22)"
published: 2026-10-23
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-unit42-oauth-consent-redirect-audit.md)

guidance from Unit 42 research (Oct 22)

2026-10-23

### Tip: OAuth phishing skips your MFA and survives password resets. Turn off user app consent, audit redirect URIs and lock down device-code sign-in

Unit 42's Oct 22 review of OAuth attacks describes three patterns: **account hijacking** (device-code phishing and authorization codes copied out of real apps' redirects), **permission hijacking** (consent to vaguely named or brand-impersonating apps) and **malicious redirects** (deliberately triggered OAuth errors that bounce victims from a real IdP to an attacker page). It also notes phishing-as-a-service templates and LLM-built lure pages.

- **Consent:** disable end-user consent for third-party apps and route requests through an admin-consent workflow. Review existing grants for vague names ("Security App") and broad mail/file scopes.
- **Redirects:** keep an inventory of registered apps and their `redirect_uri` values, and quarantine any that point at new or unmanaged domains.
- **Device code:** block the device-code flow by Conditional Access except for the accounts and devices that need it.
- **Response:** a password reset doesn't kill refresh tokens. Revoke sessions and remove the app's grant as well.
- **New consent surfaces:** developer platforms now issue OAuth tokens too. Unit 42 cites Cloudflare's self-managed OAuth clients, where a malicious grant could touch DNS and edge code.

Sources: [Unit 42: The current landscape of OAuth attacks (Oct 22)](https://unit42.paloaltonetworks.com/current-landscape-oauth-attacks/)