NIST IR 8587 finalized: new playbook targets identity token theft and forgery

NIST IR 8587, released September 15, 2026, gives federal agencies and cloud providers recommendations to prevent theft, forgery, and misuse of SAML, OpenID Connect, and OAuth 2.0 tokens, extending token protection guidance to AI agents and post-quantum…

NIST Internal Report (IR) 8587 provides implementation recommendations covering token creation, signing, validation, storage, revocation, lifecycle management, and session management across SAML, OpenID Connect, and OAuth 2.0 environments. The sources differ on attribution: Help Net Security says NIST and CISA finalized the playbook, while GBHackers attributes the September 15, 2026 release to NIST. The guidance builds on NIST SP 800-53 Rev. 5.1.1 and incorporates lessons from breaches involving stolen signing keys, abused OAuth applications, and replayed federated assertions. It cites an incident in which foreign actors forged tokens with a stolen commercial signing key to steal more than 60,000 emails from one government agency. Recommendations include strong signing algorithms, cryptographic key protection and rotation, strict claim validation, short token lifetimes, token binding, leakage prevention, and continuous monitoring for abnormal token use such as impossible travel and suspicious token reuse patterns. The report urges treating tokens as high-value credentials equivalent to authenticated sessions, defines shared security responsibilities between cloud providers and customer organizations, and promotes secure-by-design defaults from cloud service providers. It also recommends extending token protections to AI agents and preparing identity systems for a future post-quantum cryptography transition.