PRT-Based Token Reactivation After Session Revocation (DCL)

Smarth Arora@smarthxarora

•updated Jul 6, 2026•0•0•2

Detects indicators of Device Code Lab's PRT Refresh capability, where an administrator's 'Revoke all sessions' (revokeSignInSessions) action is followed by a prt-refresh backend call that reactivates the attacker's session without new user interaction, bypassing standard OAuth refresh token revocation.