I gave a presentation at the 2026 OAuth Security Workshop in Leipzig describing the actions we took when an actionable security vulnerability was discovered affecting numerous OpenID and OAuth specifications. Much of the information discussed was not previously public.
As I described when writing about a spec we created to address the problems, the security vulnerability was identified during formal analysis of the OpenID Federation specification. The vulnerability resulted from ambiguities in the treatment of the audience values of tokens intended for the authorization server. The ambiguities enabled a malicious authorization server to use the token endpoint of a legitimate authorization server as the audience value, resulting in a client authentication JWT that the attacker could use there.
The presentation detailed how the vulnerability was discussed privately among authors of affected specifications, privately disclosed to affected parties and developers, disclosed to the OAuth working group, disclosed publicly by the OpenID Foundation, and fixed in the affected specifications (which is still a work in progress). I presented the tradeoffs considered, the decisions made and the reasons for them, and reflected on lessons learned. See the presentation deck I used (pptx) (pdf).
The thoughtful, careful, and timely action by those responsible for the affected specifications and ecosystems was impressive. I was honored to be part of it.
I’ll close by saying noting that the OAuth Security Workshop came into existence in November 2015 in response to an earlier security vulnerability also discovered through formal analysis. Describing our handling of another such vulnerability at this OSW was therefore certainly in keeping with the reasons for the workshop in the first place!
