OAuth changes, MCP Authorization, & PKCE Downgrades (Ep. 169)
Source: YouTube · Critical Thinking - Bug Bounty Podcast · published Apr 9, 2026 · 30:17
The video analyzes ThreatLocker’s technical implementation of application ring-fencing using kernel-level drivers, while also detailing emerging OAuth 2.1 threats, including mandatory PKCE, CIMD-based SSRF risks, and token delegation vulnerabilities.
Key Takeaways:
• ThreatLocker enforces application behavior via ACLs and policies using three core technologies: mini-filter drivers, Windows Filtering Platform, and EX version kernel notification routines 0:36-0:52.
• Mini-filter drivers hook IO requests to approve or deny file read/write operations based on defined policies 0:54-1:03.
• Windows Filtering Platform controls network access by approving or denying connect/bind requests for specific processes and ports 0:47-0:52.
• EX version kernel notification routines allow the system to actively approve or deny native API calls, such as process creation, rather than merely receiving notifications 0:47-0:52.
• The new Client Identity Metadata Document (CIMD) flow in OAuth 2.1 introduces significant SSRF attack surfaces during manifest validation 0:54-1:03.
• OAuth 2.1 mandates PKCE, removing implicit and password flows, which shifts attack vectors toward PKCE downgrade attacks and implementation gaps 0:54-1:03.
This episode highlights how kernel-level enforcement secures applications while warning of new attack vectors in evolving OAuth standards.
Sources:
- 0:36 Introduction to ThreatLocker's ring-fencing and core technologies
- 0:47 Explanation of EX version kernel notification routines
- [0:54](https://www.youtube.com/watch?v=mo9LoNHmDhI&
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
If this becomes a standard, which I think it will be and slowly is, it actually opens up some more attack surface because we have a little bit more to play with. Best part of hacking when you can just, you know, critical thing, right? All right, y'all. We've talked about ThreatLocker ring-fencing a lot. We know how it allows you to set ACLs and policies for exactly what an application is allowed to do in your network. But today, I'm going to tell you how it does that, okay? Three technologies: mini-filter drivers, Windows Filtering Platform, and EX version kernel notification routines. Mini-filter drivers are essentially a hook or callback for um IO requests, okay? So, when you're trying to write or read from a file, you can create a hook with those and approve or deny based off of the Thr…