SNOW-24.1: Agent API Endpoint Without OAuth Scope Validation

🔴 High · ServiceNow API Authentication

Detects Scripted REST APIs and Now Assist API endpoints accessible to AI agents that lack OAuth entity scope validation. Without scope constraints, any OAuth client can invoke agent-specific endpoints.

Details

Field	Value
Rule ID	SNOW-24.1
Severity	High
Category	ServiceNow API Authentication
Platforms	servicenow

Remediation

Refer to the SquireX documentation for remediation guidance specific to SNOW-24.1.

See Also

• Rule catalog index
• SquireX scan documentation