Proof of Possession (PoP)
Proof of possession (PoP) is a property of a token or credential that requires the presenter to show it controls a specific cryptographic key, so holding the token alone is not enough to use it. RFC 7800 defines how a JWT names its PoP key in the cnf (confirmation) claim.
PoP is the answer to the bearer token problem, where anyone who copies a token can replay it. In OAuth, RFC 8705 binds access tokens to the client's TLS certificate through mutual TLS, and RFC 9449 (DPoP) has the client sign a short proof with its key on each request, which suits browser and mobile apps that cannot present client certificates; FAPI 2.0 requires one or the other. The same principle applies to client authentication: in October 2026 a CVSS 10 flaw in the SAP Cloud SDK for Python sent OAuth client IDs and secrets to an attacker-controlled host, whereas a client authenticating with a private key over mTLS never transmits anything an attacker could reuse.
See also: DPoP, mTLS, bearer token, token replay on unbound endpoints, FAPI
Related on Start with Identity
- GlossaryCertificate Lifecycle Management (CLM)
Certificate lifecycle management (CLM), often called certificate management, is the practice of discovering, issuing, renewing, and revoking X.509 certificates,
- GlossaryPKI
PKI (public key infrastructure) is the system of [certificate authorities](/glossary/certificate-authority/), [X.509](/glossary/x509/) certificates, keys and re
- GlossaryDevice Bound Session Credentials (DBSC)
Device Bound Session Credentials (DBSC) is a web standard that binds a browser session to a private key held in the device's hardware, so a session cookie stole
- BlogLXD and MicroCloud flaw let attackers pose as any trusted client using only its public certificate
Canonical's CVE-2026-112816 let an attacker authenticate to the LXD and MicroCloud HTTPS API as any trusted client by attaching that client's public certificate
- BlogSharePoint JWT bypass went from proof of concept to exploitation in under 48 hours
Rapid7 published a working PoC for CVE-2026-55040 in mid-August. Exploitation telemetry spiked from one attempt to eight the following day, from eight IPs acros