Device Code Auth Token Replay

nomit vyas@xoxo

•updated 25 days ago•0•0•2

Device code authentication flow completed, followed by subsequent session activity from a different IP/user-agent, indicating token replay to an attacker-controlled client that bypasses MFA