NIST publishes final guidance on protecting tokens from forgery and theft

NIST and CISA released the final version of IR 8587 on protecting SAML assertions, OIDC ID tokens and OAuth access tokens from forgery, replay and theft. The report lists five threat classes, including signing-key compromise, and says verification must check audience, scope and lifetime, not just the signature.

• IR 8587 was published on 15 September 2026 jointly with CISA
• Five threat classes include forgery, redirection, replay and token theft
• Sender-constrained tokens via DPoP or mutual TLS are recommended
• AI agents should get short token lifetimes and task-limited scope