Production MCPを読んで考えたこと
https://papoo.work/doc/dd73692dc8a1fded
#mcp #jsonrpc #oauth #認証 #分散システム

Waaseyaa's OAuth providers used to over-ask by default: Google always wanted a refresh token and forced consent, GitHub always fetched your email even if nobody read it. Now both take optional identity-only config. jonesrussell.github.io/blog/identit... #php #oauth

Critical F5 BIG-IP Vulnerability Exploited as Zero-Day https://redoracle.com/News/critical-f5-big-ip-vulnerability-exploited-as-zero-day.html #vulnerability #oauth #server

@huntress.com
Sideloaded AppX code abuses WWAHost and WebAuthenticationBroker to steal MFA-backed Microsoft tokens.
-
IOCs: login[.]microsoftonline[.]com, MSAppHost/3[.]0, d590ed36-52b3-4102-aeff-aad2292ab01c
-
#OAuth #ThreatIntel #Windows

A Microsoft-signed app can pop the real login screen and steal your OAuth token anyway. https://intel.threadlinqs.com/threat/TL-2026-2628 #ThreatIntel #askWAM #OAuth #TokenTheft

Critical zero-day in F5 BIG-IP OAuth server allows unauthenticated RCE. Patch now. #F5 #BIGIP #ZeroDay #OAuth #CyberSecurity #RCE https://thedailytechfeed.com/critical-zero-day-in-f5-big-ip-oauth-server-enables-rce/

Webinar tomorrow: A look at real Google Workspace breaches, where social engineering and malicious OAuth apps let attackers gain access, plus the first-hours response and controls that matter most for growing teams. #GoogleWorkspace #OAuth

「Googleでログイン」を押したあと、Googleはサービスにパスワードを渡していない。じゃあ何を渡しているのか？

#OAuth #openidconnect #認証 #Security #初心者

ERR_CONNECTION_REFUSED で Claude Code の OAuth が止まるときに見るところ
https://papoo.work/doc/601b98650a637531
#claudehowto #claudecode #err_connection_refused #oauth #codespaces

ICYMI: (06/12/2020): "Hello Microsoft Identity Platform." RPs and feedback are always appreciated! https://jjg.me/3feJbfC #Api #Articles #Azure #Entra #Identity #Managed Identity #MSAL #OAuth #WebAPI

A username and password in a config. No expiry. No scope. Nobody remembered when it was set or who else had it. That is not a security posture. That is a held breath. I wrote about the EDI auth problem. https://praveenlavu.com/dispatch/securing-the-invisible-pipeline-oauth-2-0-client #EDI #OAuth

MCP ≠ Agent Builder. Cursor/Claude/ChatGPT call send_sms, get_dlr & get_balance via OAuth+PKCE on licensed SMPP Center. Same DLT & credits.

smppcenter.com/journal/mcp-...

#MCP #SMS #AIAgents #OAuth #SMPP

`OAuth session expired and could not be refreshed` が出るときにまず確認したいこと
https://papoo.work/doc/06818a56722579cb
#claudehowto #claudecode #oauth #authentication #vscode

`OAuth session expired and could not be refreshed` が出るときにまず確認したいこと
https://papoo.work/doc/06818a56722579cb
#claudehowto #claudecode #oauth #authentication #vscode

Threat hunting in GitHub audit logs can reveal compromised accounts, stolen tokens, OAuth abuse, and API enumeration before source code or secrets are exfiltrated. #GitHub #OAuth #AuditLogs

Webinar explores real Google Workspace breaches, showing how social engineering and malicious OAuth apps gained access, and how the first response decisions can shape the impact. #GoogleWorkspace #OAuth #BleepingComputer

Draft for OAuth 4.6 Protocol Simplifies Sign-In Security By Letting Users Choose Any Account From List

A draft for a future version of the OAuth specification has been published with a controversial security measure. To simplify the sign-in process, users...
#technews #cybersecurity #oauth

🚨 Twitch extension secretly stole OAuth tokens → accounts at risk. Remove extension + reset sessions now.

🌐 urlscore.ai/blog/url-rep...

#TwitchLeak #OAuth #CyberSecurity #BrowserExtension #AccountSafety

Try it for FREE. 🆓

Vercel and Composio highlight a modern attack chain: OAuth grants, not email, can open access to Gmail, Drive, and connected systems. AI agents using legitimate tokens need stronger environment-level controls. #OAuth #GoogleWorkspace #AIagents