Security & Threat Intelligence · 25.07.2026, 15:29 UTC
JamfHound v1.1 Update: SSO Attack Paths and Okta Additions
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SpecterOps ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR : New SSO Attack Paths and Okta Edges in JamfHound: Updates have been added to the JamfHound OpenGraph collector to identify IDP integrated attack paths starting with Okta and JamfHound is now an official OpenGraph collector of BloodHound Enterprise.
Since the initial release at Black Hat USA 2025, JamfHound has received positive feedback from our clients and the broader cybersecurity community as a tool for visualizing attack paths and hardening JAMF Pro environments. At SpecterOps, we have continued investing in research to identify the most dangerous attack paths exploitable by threats targeting our customer environments. A common configuration for JAMF Pro we encounter in macOS-integrated environments during our penetration tests, purple teams, and red teams has been the use of external Identity Providers (IDPs) for authentication to JAMF Pro using single sign-on (SSO). This piqued our interest to learn more about how JAMF integrates SSO. After months of research, we are glad to share v1.1 updates to the JamfHound OpenGraph collector, featuring new attack paths affecting JAMF Pro deployments. We are elated to share that in addition to updates to the BloodHound Community Edition collector, this newest version of JamfHound will be integrating into BloodHound Enterprise this spring.
v1.1 Highlights
New Nodeo jamf_SSOIntegration – A representation of SSO configurations enabled in a JAMF Pro tenant
New Edgeso jamf_SSO_Login – A representation of the relationship between SSO configured authentication and local JAMF Pro accounts or groupso …