NIST Issues New Guidance to Protect SSO and API Tokens From Theft and Forgery
NIST released IR 8587 giving agencies and cloud providers recommendations to prevent identity token forgery, theft, and misuse in SSO and API environments.
NIST Internal Report 8587, released September 15, 2026, provides implementation recommendations covering token creation, signing, validation, storage, revocation, and lifecycle management for SAML, OpenID Connect, and OAuth 2.0 environments. It builds on SP 800-53 Rev. 5.1.1 and incorporates lessons from breaches involving stolen signing keys, abused OAuth applications, and replayed federated assertions. Recommendations include strong signing algorithms, strict claim validation, short token lifetimes, token binding, leakage prevention, and monitoring for abnormal token use.
- Covers identity tokens, access tokens, and federated assertions across SAML, OIDC, and OAuth 2.0.
- Urges treating tokens as high-value credentials equivalent to authenticated sessions.
- Recommends key rotation, strict claim validation, token binding, and leakage prevention.
- Advises continuous monitoring for impossible travel and suspicious token reuse patterns.
- Promotes secure-by-design defaults from cloud service providers.
Full article574 words · extracted from gbhackers.com · click to collapse
The National Institute of Standards and Technology (NIST) has published new implementation guidance to safeguard identity tokens, access tokens, and assertions used in single sign-on, cloud federation, and application programming interface (API) environments.
Released on September 15, 2026, NIST Internal Report 8587, titled “Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers,” provides technical recommendations for federal agencies and cloud service providers (CSPs) facing persistent threats related to tokens.
Tokens are a critical component of modern identity systems, enabling users and workloads to authenticate once and securely access multiple applications, services, APIs, and cloud resources.
However, if tokens are stolen or forged, attackers can circumvent traditional authentication controls, impersonate users, maintain persistence, and access sensitive systems without needing a password.
NIST Issues New Guidance to Protect SSO
NIST IR 8587 builds on updates introduced in NIST Special Publication 800-53 Release 5.1.1. The report outlines responsibilities for both CSPs that issue tokens and the agencies that use them, with recommendations covering token creation, signing, validation, storage, revocation, and lifecycle management.
The guidance discusses identity tokens used to establish a user or workload’s identity, access tokens that authorize requests to APIs and resources, and assertions exchanged during federated authentication workflows.
These artifacts are commonly used with protocols such as Security Assertion Markup Language (SAML), OpenID Connect, OAuth 2.0, and others.
NIST advises organizations to treat tokens as high-value credentials. A compromised token can give an attacker access comparable to, or even greater than, a stolen password because it can represent an already authenticated session.
The report urges identity providers, authorization servers, relying parties, and agencies to enhance cryptographic and operational safeguards surrounding token-based authentication.
Key recommendations include:
Using strong cryptographic signing algorithms and securely managed keys to prevent attackers from generating forged tokens.
- Enforcing strict validation of token issuer, audience, signature, expiration time, and other claims before granting access.
- Limiting token lifetime and implementing refresh-token controls to reduce the value of stolen credentials.
- Supporting key rotation and publishing trustworthy signing-key information for federated partners.
- Binding tokens to a specific client, device, workload, or cryptographic key where technically feasible.
- Preventing token leakage through browser storage, application logs, URLs, telemetry data, source code repositories, and error messages.
- Applying continuous monitoring to identify abnormal token use, including impossible travel, unusual API behavior, and suspicious reuse patterns.
NIST also emphasizes secure-by-design principles, encouraging CSPs to provide secure configurations by default rather than relying on customers to discover and enable critical protections.
The guidance incorporates lessons from high-profile breaches where threat actors obtained signing keys, stole session materials, abused OAuth applications, or replayed federated identity assertions.
Such attacks can jeopardize both on-premises and cloud environments, especially when organizations trust externally issued identity claims.
For security teams, IR 8587 reinforces the need to monitor identity infrastructure with the same urgency as endpoints, networks, and cloud workloads.
Teams should maintain an inventory of token issuers and consumers, review federation trust relationships, rotate exposed signing keys promptly, and ensure applications reject malformed, expired, or improperly scoped tokens.
This report is particularly relevant for agencies adopting cloud services and zero-trust architectures, where identity tokens increasingly determine access to enterprise resources.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.
Text extracted automatically; images, tables and formatting may be missing. Original: https://gbhackers.com/nist-issues-new-guidance-to-protect-sso/