nOAuth Abuse Leads to Full Account Takeover of Entra Cross-Tenant SaaS Applications

A critical authentication vulnerability known as nOAuth abuse has emerged as a severe threat to Microsoft Entra ID integrated SaaS applications, enabling attackers to achieve complete account takeover with minimal technical complexity.

The vulnerability exploits fundamental flaws in how application developers implement OpenID Connect authentication, specifically their reliance on mutable email attributes rather than immutable user identifiers for account management.

The nOAuth vulnerability was initially disclosed by Omer Cohen of Descope on June 20, 2023, highlighting how Microsoft OAuth misconfigurations could lead to full account compromise.

The attack leverages anti-patterns in application development where developers use email addresses as unique user identifiers, combined with Microsoft Entra ID‘s allowance for unverified email addresses across tenant boundaries.

This creates a dangerous scenario where attackers can impersonate legitimate users simply by setting matching email addresses in their own Entra tenants.

Recent research conducted by Semperis security analysts has revealed the continued prevalence of this vulnerability across enterprise SaaS applications.

In comprehensive testing of 104 applications from the Microsoft Entra App Gallery, researchers identified nine applications vulnerable to nOAuth abuse, representing approximately 9% of tested platforms.

Semperis researchers noted that several vulnerable applications contained sensitive data including personally identifiable information and integrated directly with Microsoft 365 services, potentially enabling attackers to pivot into additional enterprise resources.

The attack complexity remains remarkably low, requiring only access to an Entra tenant and knowledge of the target user’s email address.

Semperis researchers rate this vulnerability as potentially SEVERE due to the attack’s low complexity and the significant difficulty customers face in both detecting and defending against such abuse.

The simplicity of exploitation stands in stark contrast to the sophisticated nature of typical enterprise security threats, making it particularly dangerous for organizations that may underestimate its potential impact.

Technical Implementation and Attack Mechanics

The nOAuth abuse mechanism exploits a fundamental weakness in cross-tenant authentication flows within Entra ID environments.

The attack begins when an adversary creates or modifies a user account in their controlled Entra tenant, setting the mail attribute to match that of their intended victim in a separate organization.

Microsoft Entra ID permits users to have unverified email addresses to support guest user functionality, creating the foundational vulnerability.

For applications created before June 2023, the unverified email claim is emitted by default in ID tokens.

Attackers can configure app registrations with specific authentication behaviors, setting the removeUnverifiedEmailClaim parameter to false through a simple PATCH operation against the application’s authenticationBehavior configuration.

This modification enables the application to receive and process unverified email claims during the authentication flow.

{
  "removeUnverifiedEmailClaim": false
}

When the attacker initiates authentication to the vulnerable SaaS application, the application receives an ID token containing the spoofed email address.

Applications that use the email claim as their primary user identifier cannot distinguish between the legitimate user and the impersonator, automatically granting access to the victim’s account and associated data.

The attack circumvents traditional security controls including multifactor authentication, conditional access policies, and endpoint detection systems, as the authentication appears legitimate from the application’s perspective.

The vulnerability’s persistence stems from the fundamental architectural decision to rely on mutable claims rather than the immutable combination of issuer and subject claims specified in OpenID Connect standards.

This technical oversight, combined with the difficulty of detection through conventional security monitoring, creates a persistent attack vector that remains viable until application developers implement proper authentication controls.

Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now