# MFA Tidak Cukup untuk Cegah OAuth Consent Abuse > MFA melindungi proses login, tetapi tidak otomatis mencegah penyalahgunaan persetujuan OAuth. Kenali risiko token, scope, dan kontrol consent aplikasi. **URL:** https://www.ciptadusa.com/blog/mfa-tidak-cegah-oauth-consent-abuse-20260921 **Type:** blog **Author:** PT Cipta Dua Saudara **Category:** Keamanan Aplikasi **Published:** 2026-09-21 **Cover:** https://cdn-uagents.enitip.com/uploads/blog/2026-09/daily-appsec-20260921-065711.jpg ## Article MFA protects account sign-ins. It does not automatically stop an employee from approving a malicious OAuth application. That distinction matters because OAuth consent can give an attacker access through a legitimate cloud workflow. ## Ringkasan OAuth consent abuse happens when a user grants a third-party application permissions that are broader than expected. The attacker may not need to steal a password or defeat MFA. The attack moves into the authorization step, where a familiar login flow can hide a dangerous permission request. ## Mengapa MFA bukan jawaban lengkap Multi-factor authentication checks whether the person signing in has the required second factor. OAuth consent asks a different question: may this application access the user's mail, files, profile, or other business data? A valid MFA challenge can therefore be followed by an unsafe approval. The user completes the sign-in correctly, while the application receives a token with access that security teams did not intend to grant. This is why identity teams need to separate authentication from authorization. MFA strengthens the first control. It does not replace review of the second. ## Titik lemah pada persetujuan OAuth Consent screens often use technical permission names that ordinary users do not recognize. A request to read mail or maintain access to data can look like routine setup, especially when the application name resembles a known service. Attackers can also rely on social engineering. They may send a link that leads to a real identity provider, then ask the user to approve an application. The login page is genuine. The danger sits in what happens after login. Security teams should review which users may grant consent, which applications are trusted, and which permissions require administrator approval. A default allow policy gives the user more responsibility than the organization may realize. ## Kontrol yang perlu diperiksa Start by restricting user consent for high-risk permissions. Require administrator approval for applications requesting mail, file, directory, or offline access. Maintain an inventory of enterprise applications and remove registrations that no longer have an owner. Monitor new OAuth applications, unusual consent events, refresh-token activity, and access from unfamiliar locations. An approval made by a real user still deserves investigation when the application is new, the requested scope is broad, or the activity starts immediately after consent. Use conditional access and session controls where available. These controls do not replace application governance, but they can reduce the time an attacker has to use a stolen or misused token. ## Apa yang harus dilakukan setelah persetujuan mencurigakan Revoke the application's grants and refresh tokens. Review mailbox, file, and directory activity that occurred after consent. Check whether the user approved the same application for other accounts. Do not stop at a password reset. If the attacker used OAuth tokens, changing the password may not invalidate every active grant. The response must cover the application, tokens, sessions, and affected data. Document the application ID, requested scopes, consent time, approving identity, and observed actions. These details help distinguish a mistaken approval from a coordinated campaign. ## Implikasi untuk pengambil keputusan MFA remains necessary, but it covers only one part of the identity path. A mature cloud security program treats third-party authorization as its own control area, with policy, approval, monitoring, and revocation. For teams reviewing identity integrations and business applications, [tim software house Indonesia yang biasa garap aplikasi custom](https://wa.me/6285792071380) dapat membantu memetakan alur akses dan kontrol yang perlu diuji. ## Referensi - Dark Reading, MFA Won't Save You From OAuth Consent Abuse: https://www.darkreading.com/vulnerabilities-threats/mfa-oauth-consent-abuse - Microsoft Learn, OAuth 2.0 authorization code flow: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow - Microsoft Learn, Configure user consent settings: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent --- *Markdown version of https://www.ciptadusa.com/blog/mfa-tidak-cegah-oauth-consent-abuse-20260921 — generated for AI agents and LLM crawlers.*