Topic analysis

The Vercel breach: OAuth attack exposes risk in platform environment variables

In February 2026, attackers exploited a Lumma Stealer malware infection at Context.ai to compromise OAuth tokens, gaining access to Vercel's internal systems and exposing non-sensitive environment variables for a limited subset of customer projects; Vercel publicly disclosed the incident in April 2026. The breach highlights critical risks in OAuth trust relationships and Vercel's default-insecure environment variable configuration, prompting immediate credential rotation and defensive hardening guidance for affected organizations.