[saag] OAuth Security Advisory

[Eran Hammer-Lahav <eran at hueniverse.com>]

Over the past few days a security threat has been identified in the OAuth Core 1.0 protocol. While this is not an IETF protocol, it is being chartered for standardization within the IETF. Before the security threat has been disclosed, the community has been working closely with many vendors to coordinate and help them mitigate the risks involved. The attack cannot be solved without a protocol change.

The OAuth Security Advisory 2009.1 was posted on the OAuth site:

http://oauth.net/advisories/2009-1

For more information on the attack:

http://www.hueniverse.com/hueniverse/2009/04/explaining-the-oauth-session-fixation-attack.html

I serve as the community coordinator for this issue. Please feel to contact me in public or private with any concerns.

EHL