confused deputy
termcloudsecurity
A privileged service tricked into using its authority on behalf of an unauthorized caller - the deputy is honest, just confused about who is asking.
Cross-account role assumption grew external IDs specifically to break this attack.