NIST finalizes IR 8587 playbook to defend identity tokens from theft and forgery

NIST IR 8587, released September 15, 2026, gives federal agencies and cloud providers implementation guidance to prevent theft, forgery, and misuse of identity tokens across SAML, OpenID Connect, and OAuth 2.0. It is motivated in part by a forged-token attack…

NIST Internal Report (IR) 8587 was released September 15, 2026, providing recommendations covering token creation, signing, validation, storage, revocation, lifecycle management, and session management. Help Net Security reports the playbook was finalized by NIST and CISA, while GBHackers attributes the release to NIST. The guidance builds on NIST SP 800-53 Rev. 5.1.1 and incorporates lessons from breaches involving stolen signing keys, abused OAuth applications, and replayed federated assertions. It urges treating tokens as high-value credentials equivalent to authenticated sessions and defines shared security responsibilities between cloud providers and customer organizations. Recommendations include strong signing algorithms, cryptographic key protection and rotation, strict claim validation, short token lifetimes, token binding, leakage prevention, and continuous monitoring for abnormal use such as impossible travel and suspicious token reuse patterns. The report also promotes secure-by-design defaults from cloud service providers and extends token protection guidance to AI agents, with preparation for a future post-quantum cryptography transition.

• Guidance document: NIST Internal Report (IR) 8587, released September 15, 2026.
• Attribution differs by source: Help Net Security says NIST and CISA finalized the playbook; GBHackers says NIST issued the guidance.
• Scope: identity tokens, access tokens, and federated assertions across SAML, OpenID Connect, and OAuth 2.0 environments.
• Builds on NIST SP 800-53 Rev. 5.1.1.
• Cited incident: foreign actors forged tokens with a stolen commercial signing key to steal more than 60,000 emails from one government agency.
• Key recommendations: key protection and rotation, strong signing algorithms, strict claim validation, short token lifetimes, token binding, leakage prevention, and revocation controls.
• Monitoring guidance: detect impossible travel and suspicious token reuse patterns; treat tokens as high-value credentials equivalent to authenticated sessions.
• Defines shared responsibilities between cloud providers and customer organizations; promotes secure-by-design defaults from cloud service providers.