Researchers uncover OAuth client ID spoofing that enumerates Entra accounts without sign-ins, revealing a repeatable pattern ...