OAuth Client ID Spoofing Enables Stealth Account Enumeration in Microsoft Entra ID

OAuth Client ID Spoofing Enables Stealth Account Enumeration in Microsoft Entra ID

What Happened — Proofpoint’s Threat Insight team identified a growing technique where attackers submit forged OAuth client IDs (the GUID that identifies an application) to Microsoft Entra ID’s token endpoint. By doing so they can enumerate user accounts and infer password validity without ever generating a successful sign‑in event. Multiple independent campaigns were observed using this method at scale.

Why It Matters for Compliance & Audit Readiness

• The tactic bypasses traditional sign‑in log alerts, undermining the effectiveness of SOC 2 CC6.1 (Logical Access) monitoring and evidence‑collection requirements.
• Continuous‑compliance programs must capture “application‑less” sign‑in events as audit evidence of attempted unauthorized access.
• Verisq’s SOC 2 Access Controls capability provides automated log ingestion, anomaly detection, and ready‑to‑audit evidence for exactly this class of credential‑enumeration attempts.

Who Is Affected — Cloud‑based identity providers (e.g., Microsoft Entra ID), SaaS platforms that rely on OAuth 2.0, and any organization that integrates third‑party applications via OAuth.

Recommended Actions

• Map the enumeration scenario to SOC 2 CC6.1/CC6.2 controls and update your access‑control monitoring policy.
• Enable logging of sign‑in events that lack an associated application name and create alerts for such anomalies.
• Periodically review registered OAuth client IDs and enforce least‑privilege registration.
• Document detection rules and evidence collection in your continuous‑compliance repository.

Technical Notes

• Attack vector: spoofed OAuth client_id passed to /common/oauth2/token using the Resource Owner Password Credentials (ROPC) flow.
• No CVE is associated; the issue stems from Entra ID’s response behavior rather than a code flaw.
• Data at risk: user account existence and password‑validation status, which can be leveraged for credential‑stuffing or phishing.

Source: Proofpoint Threat Insight – OAuth Client ID Spoofing