Salesforce disabled integrations with two connected apps this week. The CRM company issued security advisories about GoFundMe Pro and Talent Rover after identifying “suspicious use of access tokens” associated with the third-party providers.
These messages are reminiscent of the issues Salesforce connected apps faced last year, amid a wave of social engineering attacks. This campaign in 2025 – which was not due to a compromise of the Salesforce platform – prompted the company to harden the security around connected apps. Let’s take a look at the more recent warnings.
More Connected App Problems
The first security advisory, posted on November 10, revealed that Salesforce had disabled Talent Rover connected apps and managed packages “as a precaution” after discovering “suspicious use of access tokens” associated with the third-party provider, owned by Bullhorn.
“This was a security measure taken to protect customers, not a disruption to the Salesforce platform,” Salesforce said, stressing that the issue did not arise from a vulnerability within the Salesforce platform. The company added that the affected integrations would remain unavailable until the necessary security remediation was completed.
That same day, Salesforce re-enabled the Talent Rover connected apps and managed packages following security remediation by Bullhorn.
The second warning, issued November 11, revealed that Salesforce had disabled the GoFundMe Pro connected app and associated managed packages, also after identifying “suspicious use of access tokens”. Again, Salesforce stressed that the issue did not come from a vulnerability within the core Salesforce platform.
“Salesforce and GoFundMe are working closely together to investigate this activity and safely restore the affected integrations as soon as possible,” the company said.
“The integrations will remain unavailable until necessary security remediation is complete and GoFundMe has demonstrated that the integrations can be safely restored. We continue to investigate and will notify affected customers without undue delay if we identify unauthorized access to their data.”
At the time of writing (November 12, 10:20 AM GMT), there has been no update to this message.
Summary
Salesforce disabled integrations with GoFundMe Pro and Talent Rover this week. The Talent Rover connection has been restored, while GoFundMe Pro remains disabled.
In both instances, Salesforce said this relates to suspicious use of access tokens.
