OAuth
Security incidents tagged OAuth. Newest first.
0 OAuth incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 0
- Patched
- 1
- Days without an incident
- 440
- Longest quiet run: 415 days (Sep 3–Oct 22)
Show 1 older incident1 older incident
August 2025 1
- HighNo fix needed
Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)
Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.
Salesloft Drift integration (Salesforce, Google Workspace)Closed Sep 7, 2025
