High-Frequency Automated ROPC Requests to OAuth Token Endpoint

Duo Tech@duotech

•updated Jul 14, 2026•0•0•5

Detects high-frequency Resource Owner Password Credentials (ROPC) authentication requests targeting the OAuth token endpoint. Attackers use ROPC for brute-forcing, credential stuffing, or bypassing security controls by directly passing user credentials to the OAuth flow.