OAuth

Applies to. PCI DSS v4.0.1 does not name OAuth. It comes up when an entity delegates access between applications or signs users in through an identity provider, and the standard asks of it what it asks of any access mechanism: users and system accounts are still uniquely identified under Requirement 8, MFA still applies wherever the standard requires it (delegating to a third party does not lift that), and an external identity provider is a third-party service provider whose responsibilities must be agreed and monitored under Requirement 12. Requirement 6 asks that bespoke and custom software resist attacks on access control mechanisms, including attempts to bypass or abuse authentication or authorisation, which is where OAuth's known redirect and token-handling flaws belong.