Search: “authentication”

4,282 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 4310 Ransomware 2059 Exploit / PoC 1867 Data breach 1822 Malware 1780 Phishing & fraud 1578 Threat actor 1004 Industry 904 Policy & legal 740 AI tools & infra 222 Research 187 Advisory 166 AI safety & security 109 Tools 93

SeverityAll critical 7065 high 4234 medium 3154 low 2010 info 467

Microsoft Patch Tuesday, September 2026 Security Update Review

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.

Qualys ThreatPROTECTSep 9, 12:23 UTC · 6d agoVulnerability in the wildCVE-2026-81963 CVE-2026-85880 CVE-2026-58599+27 CVEs

New Blast-RADIUS attack breaks 30-year

Ars Technica · SecurityJul 9, 19:02 UTC · Jul 9, 2024Vulnerability

Platform or roaming FIDO2 authenticators: Which one is right for your workforce?

Help Net SecurityJan 6, 18:42 UTC · Jan 6, 2023Vulnerability

Cisco introduces infrastructure agnostic, passwordless authentication by Duo

Help Net SecurityApr 1, 00:00 UTC · Apr 1, 2021Vulnerability

Deception technology: Authenticity and why it matters

Help Net SecurityDec 13, 00:00 UTC · Dec 13, 2018Vulnerability

NordPass streamlines two-factor authentication with a built-in Authenticator across devices

Help Net SecurityJan 9, 00:00 UTC · Jan 9, 2026Vulnerability

Security Vulnerability in Apple's HomeKit

Schneier on SecurityJan 27, 14:31 UTC · Jan 27, 2020Vulnerability

Why passwordless is not always passwordless

Help Net SecurityMay 20, 00:00 UTC · May 20, 2021Vulnerability

RSA Authentication SDK affected by two critical vulnerabilities, patch it now!

Security AffairsDec 4, 08:15 UTC · Dec 4, 2017Vulnerability CVE-2017-14377 CVE-2017-14378

Precious Gemstones: The New Generation of Kerberos Attacks

Palo Alto Unit 42Jun 5, 17:10 UTC · Jun 5, 2024Vulnerability

PSD2 and strong customer authentication: Are all elements equal?

Help Net SecurityMay 6, 00:00 UTC · May 6, 2019Vulnerability

OWASP Top 10 for .NET developers part 9: Insufficient Transport Layer Protection

Troy HuntNov 28, 00:00 UTC · Nov 28, 2011Vulnerability

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.

Rapid7 researchers found CVE-2026-86206 (semicolon/Forwarded access-control bypass, CWE-791, CVSSv4 6.9) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass, CWE-305, CVSSv4 7.7) in the latest N-able N-central. Chained, they let a remote unauthenticated attacker create an attacker-controlled System administrator account. The bugs stem from Envoy and Jetty disagreeing on the requested path and whether the client is local. N-able patched both in N-central 2026.3 Hotfix 3, following the earlier CVE-2026-18577 authentication bypass.

Rapid7 BlogSep 8, 11:01 UTC · 7d agoVulnerability CVE-2026-86206 CVE-2026-86207 CVE-2026-18577

January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero

Recorded FutureFeb 24, 00:00 UTC · Feb 24, 2026Vulnerability in the wildCVE-2026-21509 CVE-2026-23760 CVE-2026-1281+1 CVEs1

OAS Engine Deep Dive: Abusing low-impact vulnerabilities to escalate privileges

Cisco TalosJan 31, 17:00 UTC · Jan 31, 2024Vulnerability CVE-2023-31242 CVE-2023-34998 CVE-2023-32615+2 CVEs

The importance of computer identity in network communications: how to protect it and prevent its theft

Security AffairsDec 9, 08:07 UTC · Dec 9, 2020Vulnerability

Analyzing the security properties of a ZKTeco biometric terminal

Kaspersky SecurelistJun 11, 08:00 UTC · Jun 11, 2024Vulnerability CVE-2023-3938 CVE-2023-3939 CVE-2023-3940+3 CVEs

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing

Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.

SpecterOps' Pass-the-Passkey research showed Windows stored past YubiKey signatures in cleartext and chained this with Microsoft Entra ID passkey validation weaknesses to impersonate privileged users despite phishing-resistant MFA; the Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5) and fixed in July 2026 updates. Unit 42's Golden Pass-ta-key attack recovered the 32-byte Security Domain Secret protecting Google Password Manager synced passkeys from Chrome on Windows via pre-existing malware. Dirk-jan Mollema showed in-session malware can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric check. Microsoft applied Entra-side mitigations for the relay assertion issue; no real-world exploitation has been reported.

The Hacker NewsAug 11, 12:45 UTC · Aug 11, 2026Vulnerability CVE-2026-34348

NTLM relay attacks are back from the dead

Help Net SecurityApr 23, 13:40 UTC · Apr 23, 2026Vulnerability

Fortinet Warns of Active Exploitation of FortiOS SSL VPN 2FA Bypass Vulnerability

The Hacker NewsJan 3, 08:24 UTC · Jan 3, 2026Vulnerability in the wildCVE-2020-12812

How Attackers Bypass Synced Passkeys

The Hacker NewsOct 15, 00:00 UTC · Oct 15, 2025Vulnerability

Researchers Bypass SMS-based Multi-Factor Authentication Protecting Box Accounts

The Hacker NewsJan 18, 14:40 UTC · Jan 18, 2022Vulnerability

I know where your pet is

Kaspersky SecurelistMay 22, 10:00 UTC · May 22, 2018Vulnerability CVE-2018-9916 CVE-2018-7041

StringBleed SNMP Authentication Bypass affects numerous devices online

Security AffairsApr 28, 10:04 UTC · Apr 28, 2017Vulnerability

Stytch offers toolkit for developers to build, implement, and customize passkey-based authentication

Help Net SecurityDec 5, 00:00 UTC · Dec 5, 2023Vulnerability

New API Lets App Developers Authenticate Users via SIM Cards

The Hacker NewsJun 29, 09:51 UTC · Jun 29, 2021Vulnerability

Can we trust passwordless authentication?

Help Net SecurityOct 20, 00:00 UTC · Oct 20, 2020Vulnerability

OpenBSD addresses authentication bypass, privilege escalation issues

Security AffairsDec 6, 06:33 UTC · Dec 6, 2019Vulnerability CVE-2019-19521 CVE-2019-19520 CVE-2019-19522+1 CVEs

Instagram Adds 3 New Security Tools to Make its Platform More Secure

The Hacker NewsAug 29, 08:43 UTC · Aug 29, 2018Vulnerability

CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

MojoX::Authentication before 0.006 for Perl allows SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor (CVE-2026-86304).

CVE-2026-86304 affects MojoX::Authentication versions before 0.006 for Perl. The parse_assertion function builds Net::SAML2::Binding::POST without a trust anchor, so SAML assertions are not validated against a trusted signing key, enabling authentication bypass. The flaw is fixed in version 0.006 of the module.

oss-securitySep 6, 23:14 UTC · 9d agoVulnerability CVE-2026-86304