The National Cyber Security Centre issued an urgent OAuth redirect advisory to English councils this week after investigators tied a staff single sign-on breach at a Midlands unitary authority to a misconfigured planning portal that forwarded authorization codes to a look-alike domain, a failure pattern the agency said appears in at least six other local-government identity stacks audited since July.
What broke
Attackers registered a hostname one character removed from the council’s legitimate Microsoft Entra callback, then exploited an open redirector on a legacy “report a breach” form that appended user-supplied URLs to outbound links. Staff who clicked phishing lures believing they were renewing multifactor prompts completed a genuine Entra login, but the authorization server returned tokens to the forged callback because the portal forwarded the query string without validating the destination.
Incident responders told InfoHandle that 214 employee mailboxes were reachable for roughly nine hours before SOC analysts correlated impossible travel alerts with new device registrations. Planning caseworkers’ inboxes were the primary target because attached PDFs carry ward maps and compulsory-purchase references that resale well on criminal marketplaces. No resident payment data was confirmed stolen, but housing-benefit case notes were among messages attackers exported before refresh tokens were revoked.
What NCSC is telling councils
The advisory restates OAuth 2.0 best current practice: register every HTTPS callback explicitly, reject prefix or wildcard matching, and ban open redirectors on any page that touches authentication flows. Councils must replay the same redirect URI at the token endpoint, bind state parameters to server-side sessions, and rotate client secrets when third-party planning vendors integrate new microsites. NCSC also urged migration from implicit flows to authorization code with PKCE for any remaining mobile casework apps.
For suppliers, the message is blunt—if your SaaS dashboard lets communications teams shorten links through a generic redirect servlet, you cannot host it on the same subdomain as SSO callbacks. Several Socitm members said they are scanning Content Security Policy headers this month after the Midlands council’s vendor pushed an emergency patch that still left marketing short links on a sibling host.
Who has the file
The Information Commissioner’s Office opened a formal incident ticket once the council confirmed personal data left the tenant, triggering statutory notification timelines for staff—not residents—in this case. West Midlands Cyber Resilience Centre analysts are sharing indicators with neighbouring authorities that share the same planning software tenant. Police cyber units have not named suspects; metadata points to commodity phishing kits rather than a nation-state campaign.
Microsoft’s government team published supplementary hardening steps for Entra ID redirect URI lists, including blocking “http://localhost” entries that pen testers still find in production manifests. NCSC’s liaison desk said it will run spot checks on five more councils before quarter end, focusing on OAuth clients embedded in low-code forms built during pandemic service shifts.
What is still unknown
The breached council has not been named publicly while insurers review cyber policies tied to outsourced IT. NCSC declined to publish exploit code but said the open redirector required no authentication—any internet user could craft a link. It remains unclear whether attackers achieved persistence via refresh tokens after the council forced a global sign-out; internal logs show some mobile sessions re-registered before administrators disabled legacy app passwords.
Vendors argue the council should have segmented marketing sites from identity infrastructure years ago. Council CIOs counter that procurement frameworks bundled “citizen engagement” modules with SSO without listing redirect URI risks in security schedules. Until those contracts refresh, NCSC wants weekly attestations from chief executives that no new callback URLs were added without security review.
What IT leads should verify
Security teams should export Entra application registration lists and diff them against actual nginx routes on council domains. Any callback pointing at a content management redirector must be removed or rewritten to static paths. Tabletop exercises should include a scenario where planners click a forged Teams invite during a committee week—precisely when help desks skip callback validation to clear ticket queues.
NCSC’s guidance does not mandate a single vendor, but it does require evidence of exact URI matching in penetration-test reports due to audit committees this autumn. Councils that cannot show string-equal checks risk losing cyber insurance renewals, brokers told InfoHandle, because underwriters now treat OAuth misconfiguration as a preventable control failure rather than an exotic zero-day.
Supplier chain pressure
Planning software integrators said they are shipping hotfixes that strip redirect parameters from authenticated zones and moving short links to branded domains without SSO cookies. The trade-off is broken legacy bookmarks in councillors’ inboxes—a political annoyance CIOs accept if it prevents another authorization code leak. Training slides for non-technical staff now include a side-by-side screenshot of legitimate versus forged callbacks, with the tell being mismatched TLS certificate issuers rather than spelling errors alone.
For residents, services stayed online; the breach was inward-facing. The public policy question is whether ministers will fund centralized identity gateways so 317 councils stop maintaining their own OAuth sprawl. Until then, NCSC’s redirect warning is the closest thing to a national standard—and it lands with teeth only when insurers and the ICO treat each open redirector as negligence, not bad luck.
