The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) have released final technical guidance to prevent attackers from forging, stealing, replaying, or misusing identity and access tokens. Released as NIST Interagency Report 8587 on September 15, 2026, it provides federal agencies and cloud service providers with a roadmap for securing single sign-on, identity federation, API access, and machine-to-machine authentication environments. CISA NIST Identity Token Security However, adversaries who steal a legitimate token, compromise a signing key, or exploit weak validation can bypass multifactor authentication and access connected resources as trusted users.
The technical checklist enhances token verification by requiring issuers, subjects, or clients, intended audiences, issuance times, validity windows, unique token identifiers or nonces, authentication times, and signatures.
For theft and replay resistance, use sender-constrained mechanisms like mutual TLS and Demonstrating Proof of Possession, combined with explicit audience restrictions and fine-grained conditional-access decisions informed by device, network, geolocation, and behavioral context. NIST IR 8587 extends these safeguards to agency AI systems when agents use signed tokens to access tools, data, APIs, or services, while noting that broader AI identity risks require additional standards. It also urges agencies and CSPs to inventory public-key cryptography and prepare for post-quantum migration, as larger quantum-resistant keys and signatures may strain JWTs, browser cookies, and HTTP headers.
