Device Authorization Grant
An OAuth 2.0 flow (RFC 8628) for input-constrained devices like TVs and CLIs. The user authorizes on a second device using a short code.
Device code flow is the most abused legitimate flow in identity right now. It deliberately separates the device requesting access from the device approving it, which is what makes it work for a TV and what makes it perfect for phishing: the victim approves a real Microsoft or Google prompt, and the attacker receives the tokens. Both state-linked crews and commodity kits adopted it in 2026. If your tenant has no input-constrained devices, disable it by policy.
See also: OAuth 2.0, authorization code flow, token theft, conditional access
Related on Start with Identity
- GlossaryPAR
Pushed Authorization Requests (RFC 9126). The client sends authorization parameters directly to the server over a back channel first, hardening the flow against
- GlossaryPKCE
Proof Key for Code Exchange (RFC 7636). A binding between an authorization request and the code exchange that prevents intercepted authorization codes from bein
- GlossaryGNAP (Grant Negotiation and Authorization Protocol)
GNAP, the Grant Negotiation and Authorization Protocol ([RFC 9635](https://www.rfc-editor.org/rfc/rfc9635), Proposed Standard, October 2024), is an IETF delegat
- CVEF5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day
BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploit
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.