Persistent OAuth Tokens Without Expiration Pose Major Security Risk
Disable or rotate all long‑lived OAuth tokens and enforce expiration policies.
Disable or rotate all long‑lived OAuth tokens and enforce expiration policies.
Summary
Persistent OAuth tokens that never expire are a growing security blind spot for organizations using Google or Microsoft services.
These tokens are created during app integrations and, once issued, remain valid indefinitely unless manually revoked. Because they lack an expiration date, perimeter controls and MFA do not detect or block their misuse, allowing attackers to hijack accounts without needing a password.
The tokens are often left behind after employees leave or apps are decommissioned, creating a long‑lived attack surface. Current best practice is to enforce token expiration and automatic revocation, but many organizations still rely on manual cleanup. Without these controls, attackers can use the tokens to access sensitive data or perform privileged actions. Immediate action is required to audit, rotate, and enforce expiration on all OAuth tokens.
Key changes
- OAuth tokens can be issued without expiration dates
- Tokens remain valid indefinitely if not manually revoked
- Perimeter controls and MFA do not detect token misuse
- Attackers can hijack accounts using long‑lived tokens
- Many organizations lack automated token cleanup
- Enforcing token expiration and revocation is recommended