Cloud Services · CLD-026

Could somebody access a cloud account without knowing the password?¶

Yes. A person may access a cloud account without knowing the current password.

They may use an existing session, a stolen session token, a trusted device, a linked application, delegated access, a recovery process or another identity provider.

What this means in practice¶

An attacker may also use consent phishing or malicious OAuth access. In that situation, the user authorises an application, and the attacker gains access through the granted permissions rather than by stealing the password.

In an organisation, administrators may reset credentials, impersonate users or access data through elevated roles, depending on the service and configuration.

This matters when assessing compromise. A user may truthfully say they never shared the password while the account was still accessed through another route.

What this may show¶

Provider logs may distinguish between password authentication, token-based access, single sign-on and application activity. If they do not, seek clarification before assuming how access occurred.

What this does not show on its own¶

The dangerous assumption is that no password knowledge means no account access.

A browser or application may remain signed in for days or months. Changing the password may not immediately end every session. An access token may allow an application to continue acting until it expires or is revoked.

It also matters operationally. A password reset alone may not remove all access. Sessions, refresh tokens, trusted devices and delegated applications may need separate revocation.

Do not make changes to a live evidential account without considering preservation and specialist support.

What to do next¶

Look for session creation, token issuance, remembered devices, delegated applications, recovery events, administrator actions and changes to authentication settings.