Vercel 2026 OAuth Token Breach via Context.ai

Vercel, a frontend cloud platform, disclosed a security incident stemming from a compromise at Context.ai, a connected third-party application. The breach involved stolen OAuth tokens that enabled unauthorized access to Vercel employee accounts. The incident was publicly disclosed on 27 April 2026 via Check Point Research's Threat Intelligence Bulletin.

The attack chain began with the compromise of Context.ai, where threat actors stole OAuth tokens that Vercel had authorized for integration. These tokens were then used to gain unauthorized access to Vercel employee accounts. The specific initial access vector at Context.ai remains undisclosed, but the exploitation relied on the stolen tokens to bypass authentication controls. The data compromised includes OAuth tokens and the resulting access to employee accounts; no customer data or production systems have been confirmed as impacted.

No further post-incident details have been released. There is no mention of regulatory notifications, litigation, ransom payments, or specific containment milestones beyond the disclosure itself.