An OAuth authorization server is the component that authenticates the user or client, decides whether access should be granted, and issues access tokens or refresh tokens. In an OAuth flow, it sits at the trust boundary: it is the system that turns a successful login and consent decision into a signed token that other services will accept.
This role matters because compromise of the authorization server can let an attacker mint valid tokens, bypass normal login controls, or change who is allowed to access protected resources. In real environments, access gateways and identity appliances may run in this role, so a flaw there can affect many applications at once. Defenders should inventory which systems act as authorization servers, limit that role to the minimum necessary, monitor token issuance and unusual authentication activity, and patch quickly when vulnerabilities are found.