OAuth Bearer Token Reused from Different IP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the potential reuse of an OAuth Bearer token from different IP addresses. It monitors HTTP traffic for the 'Authorization: Bearer' header and triggers an alert if the same token is observed from more than 20 distinct destination IP addresses within a 10-second window. This behavior can indicate an attempt to bypass authentication or session management, potentially through token theft or replay.