Depending on the client type, there are different ways that access tokens may be revealed to an attacker. Access tokens could be stolen from the device if the application stores them in a storage device that is accessible to other applications.
OAuth 2.0 Threat Model and Security Considerations (RFC6819, section 4.1.3)
This threat is considered fully mitigated if all the test cases from the following test set succeed.
Back to the threat overview