Chasing Unicorns: A Lovable Security Story
summary
Research into the fastest unicorns finds the same mutable user.mail claim misuse across multiple SaaS platforms; researchers set up SAML/OIDC federation + token issuance, spoof the founder/admin at unicorn.ai, and gain tenant-level access that pivots to access to Fortune 500 enterprise customers and unreleased product designs. The exploit chains on unverified, mutable email attributes in Microsoft Entra ID and confirm that email-based authorization fails; mitigation requires validating tenant/subject/actor and relying on verified-domain claims.
AI-written summary · about
related talks
37mPreventing Authentication Bypass: A Tale of Two Researchers
33mYour Identity Is Mine: Techniques & Insights From OS Identity Providers Research
31mHow to make a Unicorn...
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
54mKeynote: Unicorn Hunting
39mRed Teaming from outside: Identifying and exploiting SaaS systems... (Rojan Rijal)
47mThe Storm-0558 Attack - Inside Microsoft Identity Security's Response
22mDevSecOps - The Story of 3 Security Breaches