18 stories tagged oauth, newest first.
60 points by simfinii | 44 comments
Landing page for Alter, a YC S25 startup offering a proxy that manages credentials, policies, and audit logs for AI agents acting on behalf of multiple users.
204 points by soeckly | 101 comments
A security writeup describing how a self-contained Flask session secret on Google DevSite enabled forged sessions and remote code execution across seven Google domains for a $90,000 bounty.
158 points by thdr | 93 comments
X post thread where David Soria Parra asks Figma to fix its remote MCP server, which only accepts whitelisted client names like Claude Code and rejects Pi.
348 points by terryds | 147 comments
Cloudflare blog post announcing OAuth support available to all developers to build third-party apps integrating with Cloudflare accounts.
339 points by Kwastie | 172 comments
GitHub issue on the homeassistant-volkswagencarnet integration reporting that login no longer works while the official Android app still does.
356 points by queenelvis | 116 comments
Trend Micro research article analyzing the April 2026 Vercel breach, an OAuth supply chain compromise exposing risks of platform environment variables.
718 points by srigi | 598 comments
Google AI developer forum thread where a Google AI Ultra subscriber reports their account was restricted without warning after using OAuth via OpenClaw.
348 points by ramimac | 135 comments
Blog post by Joshua Rogers describing security issues he reported in Okta's auth0/nextjs-auth0 library, including an OAuth parameter injection, and the AI-slop handling of his fix.
335 points by the1bernard | 102 comments
Eye Security research post describing how misconfigured Entra OAuth apps could be abused to gain access to internal Microsoft applications.
392 points by bqmjjx0kac | 119 comments
Immich project page listing "cursed knowledge": surprising bugs and quirks in tools and platforms the developers ran into while building the photo app.
775 points by gregorywegory | 479 comments
GitHub repository for Cloudflare's workers-oauth-provider, an OAuth library for Cloudflare Workers largely written with Claude, with prompts recorded in commit history.
466 points by simiones | 255 comments
Truffle Security blog post describing how buying expired domains of failed startups lets attackers log into former employees' accounts via Google OAuth.
374 points by franciscop | 119 comments
A blog post written as short letters to OAuth providers like GitHub and Facebook, pointing out spec violations such as token endpoints returning 200 for errors.
681 points by sebnun | 172 comments
The Copenhagen Book is a free, open-source, community-maintained guide to implementing authentication in web applications, by Pilcrow.
443 points by n2d4 | 90 comments
Stack Auth blog post explaining OAuth 2.0 by starting from a flawed authorization implementation and iteratively attacking and fixing it.
392 points by sschueller | 239 comments
Google Workspace Updates post announcing that from September 30, 2024, third-party apps using only passwords to access Google Accounts and Google Sync will no longer be supported.
349 points by skilled | 102 comments
A security researcher's write-up on leaking Microsoft account OAuth tokens through an open redirect vulnerability in the Harvest time-tracking app.
530 points by bastienbeurier | 255 comments
Nango blog post explaining why implementing OAuth across the 50 most popular APIs remains messy and inconsistent in 2023.