BSidesSF 2026 - Breaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows (Bhaumik Shah)

This talk by Bhaumik Shah explores the vulnerabilities in modern authentication systems, specifically focusing on OAuth, OpenID Connect (OIDC), and JSON Web Token (JWT) authentication flows. The speaker demonstrates real-world attacks, including token replay and session hijacking, while highlighting how insecure configurations can lead to system compromises. Practical defense strategies are also shared, providing insights into securing authentication processes against these modern threats.