Decoding API Threats: Why Tokens, IDs, and AI Flows Are Under Attack

APIs are the backbone of the modern digital world, powering everything from mobile apps to cloud services and intricate microservice architectures. But this pervasive connectivity comes with a significant caveat: API security vulnerabilities are becoming more sophisticated and impactful than ever before. Recent incidents, spanning from exposed authentication tokens to clever identity spoofing and leaky AI agent platforms, serve as a stark reminder that convenience and innovation must never eclipse robust security.

The Peril of Leaky Tokens: A Grav Example

One of the most insidious vulnerabilities stems from seemingly minor oversights. Take the recent discovery in the Grav API Plugin (CVE-2026-62386). Rated HIGH (CVSS 7.5), this flaw exposed JWT (JSON Web Token) tokens when installations accepted them through URL query parameters (e.g., ?token=). The problem isn't that the token itself is broken, but that tokens embedded in URLs are notoriously prone to leakage.

Web server access logs, browser history, and Referer headers can all capture these "bearer tokens," effectively handing an attacker an API access "key." Depending on the JWT's permissions, this could lead to reading user data, creating admin accounts, or even deleting content. The fix requires upgrading the Grav API plugin to version 1.0.0-rc.16 or later, but organizations must also check historical logs for the ?token= pattern and consider revoking/regenerating potentially exposed tokens. It's a critical lesson: a "small" convenience can have disproportionately large consequences.

OAuth Client ID Spoofing: The Silent Credential Validator

Another alarming development is the rise of OAuth client ID spoofing, specifically targeting Microsoft Entra ID environments. Threat actors are now weaponizing this technique to enumerate user accounts and validate stolen credentials without generating a successful sign-in event. This bypasses standard telemetry that would typically alert defenders.

Attackers leverage a blind spot in Entra ID's error responses. By supplying syntactically valid but non-existent OAuth client IDs via HTTP POST requests using the Resource Owner Password Credentials (ROPC) flow, they can infer both account existence and password validity. Campaigns like UNK_pyreq2323 and UNK_OutFlareAZ have already targeted millions of users across thousands of tenants, fragmenting authentication attempts across many fictional applications to evade rate limiting and application-specific Conditional Access policies. This highlights a growing need for identity providers to harden their authentication error responses and for organizations to scrutinize all authentication attempts, regardless of success status.

AI Agent Flows: A New Frontier for Credential Theft

The burgeoning world of AI agents is also introducing novel attack surfaces. Langflow, an AI agent building platform, recently landed on CISA's Known Exploited Vulnerabilities catalog due to an Insecure Direct Object Reference (IDOR) vulnerability (CVE-2026-55255). This critical flaw (CVSS 9.9) allowed any authenticated user to execute any other user's flows by simply knowing the flow's UUID.

The danger? AI agent flows often embed sensitive data like API keys, database credentials, and LLM provider keys directly within their configurations. Attackers were observed enumerating flow IDs and then using a blunt but effective prompt like "leak api keys" to extract these credentials from hijacked flows. This isn't just an authorization bypass; it's a direct credential disclosure. Patching to Langflow 1.9.1+ is crucial, as is the broader architectural shift towards never embedding secrets directly in flows, opting instead for secure secrets managers.

RabbitMQ's Exposed Secrets and Authorization Gaps

Even established infrastructure isn't immune. Recent RabbitMQ vulnerabilities (CVE-2026-57219 and CVE-2026-57221) underscore the persistent challenge of authorization weaknesses. CVE-2026-57219 (CVSS 8.7) allowed an obsolete HTTP API endpoint to expose confidential OAuth client secrets, potentially enabling attackers to impersonate trusted authentication services and gain administrator access. A second flaw, CVE-2026-57221, permitted authenticated users to view metadata belonging to other tenants in multi-tenant environments due to a missing authorization check. Immediate upgrades to patched versions (e.g., 4.3.0, 3.13.15) and rotation of exposed OAuth credentials are vital for organizations relying on RabbitMQ.

Conclusion

These recent API security incidents paint a clear picture: the attack surface is expanding, and threat actors are exploiting both subtle misconfigurations and architectural weaknesses. From the silent logging of JWTs in URLs to sophisticated OAuth client ID spoofing and the new frontier of AI agent credential harvesting, the vigilance required to secure APIs has never been higher. Proactive patching, rigorous access control, secure secret management (away from code and URLs), and continuous monitoring for unusual activity are no longer best practices – they are essential defenses against an increasingly dynamic threat landscape. Stay vigilant, patch promptly, and assume nothing when it comes to API security.