Search: “ResidualAuth”

27 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

SeverityAll critical 0 high 0 medium 0 low 0 info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?

Formalizes residual authorization state language agents must preserve under revocable delegation; token-budget summaries mostly fail while hard gates stop unauthorized effects.

The paper shows two authorization histories with identical current permissions can require opposite decisions after the same direct-edge revocation, formalizing the needed information as residual authorization state. Exponentially many future-distinct states can share one transitive closure, with exact or tight asymptotic bounds on the state an exact monitor requires. Across four open-weight models, fixed 256-token summaries solved at most 2 of 16 paired episodes while authenticated current-query reads solved 15-16 of 16. A hard effect gate reduced eight observed unauthorized effects to zero without changing preceding attempts.

arXiv cs.CRSep 8, 00:05 UTC · 8d agoResearch

Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

watchTowr observed active exploitation of CVE-2026-5430, a WSO2 API Manager JWT bypass using forged admin tokens, risking credential theft and account takeover.

CVE-2026-5430 (CVSS 9.8-10.0), an improper cryptographic signature verification flaw in WSO2 API Manager, lets JWT authentication be bypassed with unsupported algorithms, enabling administrative account takeover. watchTowr honeypots captured forged JWT tokens with baked-in administrator privileges on September 13, 2026, which could expose API credentials, consumer keys, and secrets for every registered application. Affected products include WSO2 API Manager 4.1.0-4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Fixes are available via GitHub pull requests and subscription update levels, and users are urged to patch immediately.

The Hacker Newsupdated 15:05 UTC · 8h agofirst 05:18 UTC · 17h agoExploit / PoC in the wild 3 sources CVE-2026-5430

CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

Apache Airflow FAB provider 3.2.0-3.8.x password changes do not invalidate database-backed sessions, letting stolen session cookies survive a password reset.

CVE-2026-86462 affects apache-airflow-providers-fab versions 3.2.0 before 3.9.0. Changing a user's password via the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie retains full access as that user after the password change. Severity is rated moderate.

oss-securitySep 15, 19:59 UTC · 1d agoVulnerability 3 sources CVE-2026-86462

This Key Will Self-Destruct: An Open Standard for Revocable API Keys

SecurityWeek opinion piece proposes ORKS, an open standard adding issuer prefixes, discovery files, and unauthenticated revocation endpoints to make leaked API keys quickly revocable.

The article argues that plain API keys leak frequently yet lack any standardized revocation mechanism, unlike OAuth tokens which gained RFC 7009 revocation in 2013, and that GitHub's Secret Scanning Partner Program solves this only in a proprietary, invite-only way. The author proposes ORKS (Open Revocable Key Standard), with a draft spec on GitHub, built on four parts: keys embedding their issuer domain in a fixed prefix format, a discoverable /.well-known/api-key-config JSON file, unauthenticated revocation by possession of the full key, and declared constraints such as IP allowlists, expiry, scopes, and mTLS. An optional quarantine mode inspired by Toyota's andon cord restricts a reported key to read-only and throttled operation for a default 24-hour window before automatic revocation. The piece frames AI agents as making this urgent, since agents hold many credentials, can exfiltrate them via prompt injection, and can leak secrets into logs at machine speed.

SecurityWeekSep 9, 10:00 UTC · 7d agoTools1

iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset

Abnormal Security details iAuthFlow v2, a $10,000 phishing kit that enrolls attacker-controlled passkeys on Google accounts, persisting through password resets.

Abnormal Security analyzed iAuthFlow v2, a phishing toolkit sold on a Russian-language cybercrime forum for a $10,000 base price with additional capability modules sold separately. Using a browser-in-the-middle relay behind a trycloudflare.com subdomain with valid TLS, it captures Google logins and uses the authenticated session to enroll an attacker-controlled passkey within six seconds of login. Because the passkey persists after password changes and session revocation, operators regain mailbox access even after victims reset credentials. The build examined targets Google, while the seller advertises versions for Microsoft, iCloud, and LinkedIn.

Security AffairsAug 24, 07:17 UTC · 23d agoPhishing & fraud1

[webapps] Duplicati 2.2.0.3 - JWT Signing Key Leak

A public exploit exposes JWT signing key leakage in backup software Duplicati 2.2.0.3, risking session forgery.

Exploit-DB published exploit #52646 for Duplicati 2.2.0.3, a backup application. The issue leaks the JWT signing key, which could let an attacker forge authentication tokens. The disclosure does not report any exploitation in the wild.

Exploit-DBAug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC

CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow FAB provider 2.0.0-3.8.x lets deactivated users keep unexpired Core API JWTs and mint replacements indefinitely.

CVE-2026-82310 affects apache-airflow-providers-fab versions 2.0.0 before 3.9.0. Deactivating a user account does not stop tokens issued before deactivation. While password authentication correctly rejects the disabled account, the Core API continues to accept an existing unexpired token naming it and lets that token mint a replacement. Severity is rated moderate.

oss-securitySep 15, 19:56 UTC · 1d agoVulnerability CVE-2026-82310

A rant about phishing: It's not the user's fault (and not DNS either)

Opinion piece argues multi-domain login redirects make legitimate flows indistinguishable from phishing, urging organizations to standardize on one recognizable root domain.

The author shows a real-world login flow that chains through numerous third-party domains (identity providers, cloud auth endpoints, OAuth APIs, 2FA pages), none on the company's own domain, so credentials and 2FA prompts are trivially impersonable. The piece argues URLs are inherently confusing because the security-relevant second-level domain sits mid-string, and that users trained to ignore URLs cannot distinguish legitimate pages from scams. It proposes RFC 2119-style requirements: single recognizable root domain, internal services on its subdomains, emailed or SMS links on that domain, and local redirects instead of third-party hosted pages.

Lobsters · securitySep 10, 15:14 UTC · 6d agoPhishing & fraud

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.

Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.

Wiz BlogSep 9, 16:06 UTC · 7d agoExploit / PoC in the wildCVE-2026-59822 CVE-2026-598211

[webapps] miniOrange 5.4.3 - Unauthenticated Auth Bypass

A proof-of-concept exploit for an unauthenticated authentication bypass in miniOrange 5.4.3 has been published on Exploit-DB.

Exploit-DB lists a public proof-of-concept exploit for an unauthenticated authentication bypass in miniOrange 5.4.3. The flaw allows attackers to bypass authentication without credentials. No in-the-wild exploitation or CVE identifier is stated in the listing.

Exploit-DBSep 1, 00:00 UTC · 15d agoExploit / PoC

Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain

The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.

The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.

Cyber Security NewsSep 8, 12:10 UTC · 8d agoThreat actor in the wild

Attackers are going after prominent individuals through OAuth phishing, FBI warns

FBI IC3 warns of ongoing OAuth consent phishing since late 2025 targeting prominent individuals to gain persistent, password-free account access.

Attackers register malicious applications with legitimate OAuth providers, impersonate journalists, academics, event organizers, or government officials on messaging apps and email, and lure targets into approving permission requests on real Microsoft or Google login pages. Once approved, the attacker's application can read and send emails and access sensitive files within granted permissions, bypassing both passwords and MFA. The FBI notes password changes do not revoke this access; victims must invalidate the OAuth token in application security settings, and no attribution or victim list has been disclosed.

Help Net SecuritySep 2, 00:00 UTC · 14d agoPhishing & fraud in the wild

CVE-2026-16232: Checkpoint Quantum Security Management auth bypass ...

Attackers exploit Check Point SmartConsole authentication bypass CVE-2026-16232 to take over Quantum Security Management firewall servers; CISA added it to KEV.

CVE-2026-16232 is an authentication bypass (CWE-287) in the SmartConsole login process of Check Point Quantum Security Management, exploitable via an application token. Disclosed July 22, 2026, it was added to CISA's Known Exploited Vulnerabilities catalog the same day with remediation due July 25. Rapid7, Check Point Research and other vendors confirmed exploitation in the wild, and a public PoC was released. A workaround is available, and federal agencies must comply with BOD 26-04 patching guidance.

Web discovery (articles for new exploits & KEV entries)Sep 5, 08:03 UTC · 11d agoExploit / PoC in the wildCVE-2026-16232

VU#889462: Casdoor authentication server is vulnerable to authorization bypass

Casdoor IAM versions 3.115.0 and earlier allow organization admins to bypass tenant isolation through inconsistent authorization checks, tracked as CVE-2026-15630.

CERT/CC published VU#889462 describing an authorization bypass in Casdoor, an open-source access management platform, affecting versions 3.115.0 and earlier. The flaw (CVE-2026-15630) stems from controllers ignoring the ?id= query parameter used for authorization decisions and acting on JSON body fields instead, letting a single-organization administrator perform unauthorized administrative actions against arbitrary organizations in multi-tenant deployments. Impact can escalate to complete tenant-isolation compromise and potential compromise of the entire Casdoor instance, including SSO/SAML disruption. No vendor patch is available because researchers could not reach Casdoor; mitigations include least privilege, MFA for admin accounts, and alerting on cross-organization administrative activity.

CERT/CC Vulnerability NotesSep 3, 17:03 UTC · 13d agoVulnerability CVE-2026-15630

Revolut discloses data breach exposing financial info, passports

Revolut disclosed a breach after a threat actor spoofing a government agency's email domain obtained customer passports, selfies, IBANs, and full transaction histories.

Revolut told affected customers that a threat actor sent a data request from an unauthorized email account on an official government agency's domain, carrying valid domain authentication credentials, and staff fulfilled it believing it legitimate. Exposed data includes identity details, contact information, passport and driver's license copies, KYC facial verification selfies, IBANs, withdrawal records, and full transaction histories including Bitcoin. Revolut calls the number of affected customers 'very limited' but refuses to give exact figures, while ZachXBT says high-net-worth users appear targeted. This follows a 2022 Revolut breach affecting 50,150 customers.

BleepingComputerSep 14, 08:48 UTC · 2d agoData breach1· 1 read

GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation

eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.

eSentire's Threat Response Unit observed GhostCode campaigns in late August 2026, using BEC-style social engineering that impersonated procurement staff, including BJ's Wholesale Club, via Salesforce contact forms. Victims received password-protected HTML lures disguised as a FlipBook document portal, with junk-data padding, HTML comment injection, and AES-256-GCM encrypted redirects gated by anti-bot checks. The kit exploits the OAuth 2.0 device authorization grant, prompting victims to approve real Microsoft device-code sign-ins with MFA. Within 78 seconds of approval, attackers registered three Entra devices and obtained a Primary Refresh Token, so rogue device registrations persist even after session token revocation.

GBHackers13:41 UTC · 9h agoPhishing & fraud in the wild

When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Cloudflare's Page Shield ML uncovered four malicious JavaScript campaigns on storefronts, including affiliate fraud and a remote-backdoor script, that VirusTotal and URLScan missed.

Cloudflare's Page Shield ML detected four client-side JavaScript operations (eight payloads) in live traffic on online storefronts, enabling affiliate commission hijacking, clickless affiliate theft via hidden iframes, user tracking with a remote-code backdoor, and cloaking of paid mobile visitors. Seven of the eight payloads were absent from VirusTotal and URLScan returned no malicious verdict for any, including a Lnkr-family payload indexed unclassified for roughly 2.5 years. Detection relies on a graph neural network over JavaScript syntax trees, an LLM second opinion on Workers AI, and a frontier-model ensemble voting across benign, magecart, other malware, and cryptomining labels.

Cloudflare Blog20:06 UTC · 3h agoMalware in the wild

Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks

Attackers stole a METR API key via an exposed agent-run EC2 instance and consumed about $600,000 in public model credits over three weeks.

AI evaluation nonprofit METR disclosed two incidents. In March 2026, a fail-open bug in a vibe-coded app disabled authentication on a publicly accessible EC2 instance; an attacker prompted the running agent to reveal a model provider API key, added an SSH key for persistence, and consumed roughly $600,000 in free public-model credits over three weeks without being noticed. In May 2026, attackers probed METR's public infrastructure using agents, automated vulnerability discovery, credential stuffing, OAuth token attempts, and phishing; a separately exposed read-only SQL mechanism found by a bug bounty hunter risked leaking unpublished evaluation data, but no access to non-public data was confirmed.

The Register · SecuritySep 1, 20:45 UTC · 15d agoData breach in the wild1

Another Artifactory CVE under attack by AI agents or humans

Attackers are actively exploiting CVE-2026-82329, a critical JFrog Artifactory authentication bypass, minting admin tokens on exposed servers days after patch release.

CVE-2026-82329 is a CVSS 9.8 unauthenticated authentication bypass in JFrog Artifactory, disclosed Friday, that allows attackers to create new administrative credentials. watchTowr's honeypots recorded exploitation from a small number of IPs within days, including enumeration of users, groups, credential sets, and federated access topologies. Researchers urge urgent patching, credential rotation, and treating exposed instances as potentially compromised to prevent build-pipeline tampering and downstream supply-chain impact.

The Register · SecuritySep 1, 21:07 UTC · 15d agoExploit / PoC in the wild 2 sources CVE-2026-82329

Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers

NIST and CISA publish final interagency report with implementation guidance for protecting tokens and assertions from forgery and misuse.

CISA released a final NIST/CISA interagency report guiding federal agencies and cloud service providers on protecting identity assertions, access tokens, and cryptographic mechanisms underlying modern authentication and authorization. It addresses forgery, theft, and misuse of signed tokens that adversaries use for lateral movement and data access in hybrid and multi-cloud, SSO, federation, and API-based environments. The final version updates token validation, secrets management, and detection-at-scale guidance gathered via the Joint Cyber Defense Collaborative, and supports Executive Order 14306 and Secure by Design principles.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.

Rapid7 documented a previously undocumented Linux toolkit named ted compiled into the HAProxy load balancer binaries of two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, serves altered pages only to filtered visitors, and hides C2 exchanges from backend logs and HAProxy statistics; a companion RAT, curlRAT, beacons on a default 12-hour schedule. The toolkit also trojanizes crond, sshd, agetty, atd, and polkitd binaries and sanitizes logs and bash history. Rapid7 attributes the activity with medium confidence to North Korean state-sponsored actors, with domain infrastructure overlapping APT37 listings in maltrail and delivery resembling the Operation SyncHole campaign.

The Hacker NewsSep 4, 14:51 UTC · 12d agoThreat actor in the wild

Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

Rapid7's analysis of SharePoint auth bypass CVE-2026-55040 includes a PoC for unauthenticated admin-level operations.

Rapid7 and Microsoft disclosed CVE-2026-55040, an authentication bypass in Microsoft SharePoint, on July 14, 2026. The flaw stems from multiple issues in SharePoint's JWT token validation pipeline, allowing a remote unauthenticated attacker to bypass authentication and perform operations as a site user or administrator. Rapid7 has now published a technical analysis and a proof-of-concept script, based on SharePoint Server Subscription Edition.

Rapid7 BlogAug 11, 13:00 UTC · Aug 11, 2026Vulnerability CVE-2026-550401

Revolut Exposed KYC Data After Fraudulent Government Email Passed Security Checks

Revolut handed over KYC documents, selfies, and Bitcoin transaction histories to attackers after a fraudulent email from a genuine government domain passed authentication checks.

Revolut confirmed on September 12, 2026 that it disclosed sensitive customer KYC data to an unauthorized third party after a fraudulent information request was sent from an email account operating inside a real government agency's domain, carrying valid domain authentication credentials. The exposed data included identity documents (passports, driver's licenses), verification selfies, birth dates, contact details, IBANs, account statements, and full transaction histories including Bitcoin. Revolut discovered the fraud only after independently verifying with the agency, blocked the sender, and notified law enforcement and financial regulators, but did not disclose the number of affected customers or the agency involved. Researcher ZachXBT assessed the operation was targeted at high-net-worth users, useful for fraud, impersonation, or extortion.

Security AffairsSep 12, 21:05 UTC · 4d agoData breach

Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable

Attackers actively exploit two CVSS 9.8 auth bypasses (CVE-2026-61979, CVE-2026-15981) in the miniOrange SAML WordPress plugin, forging SAML responses to become admin.

CVE-2026-61979 is a SAML algorithm confusion flaw that lets attackers sign forged assertions using the identity provider's RSA public key as an HMAC secret; CVE-2026-15981 stems from PHP treating openssl_verify()'s -1 error return as true, allowing a crafted signature that triggers an OpenSSL error to validate. Both bugs independently let unauthenticated attackers obtain WordPress administrator sessions and both are confirmed exploited in the wild. DigitalOcean discovered the exploitation via a network anomaly after public vulnerability databases covered only the Free edition (fixed in 5.4.5), leaving seven independently versioned paid editions appearing patched. Attackers are scanning SSO endpoints from six IPs in Belgium, Nigeria, the US and Germany, and paid-edition fixes require manual uploads across version lines.

Security AffairsAug 25, 16:43 UTC · 22d agoExploit / PoC in the wildCVE-2026-61979 CVE-2026-15981

Revolut Data Breach Exposes Customers’ Passport Copies and Full Transaction Histories to Hackers

Revolut leaked KYC documents and full transaction histories after a fraudulent, domain-authenticated email request impersonating a government agency.

Revolut disclosed that an attacker using an unauthorized email account on a legitimate government domain, with valid domain-authentication credentials, tricked the fintech into releasing customer data. The exposed data includes passport and driver's license copies, identity-verification selfies, full names, dates of birth, addresses, IBANs, and complete transaction histories including Bitcoin activity. Revolut says core systems, accounts, and funds were not compromised, and it blocked the email source and notified authorities. On-chain investigator ZachXBT and others indicated the operation targeted high-net-worth users facing elevated phishing, SIM-swap, and extortion risk.

Cyber Security NewsSep 13, 05:09 UTC · 3d agoData breach3· 1 read

CVE-2026-37171: SuperTokens Core cross-tenant session isolation bypass (6.0.0-11.4.0)

CVE-2026-37171: SuperTokens Core 6.0.0-11.4.0 lacks tenant separation in session operations, enabling cross-tenant access.

CVE-2026-37171 (CWE-863, Incorrect Authorization) affects SuperTokens Core, the self-hosted authentication server by SuperTokens Inc., versions 6.0.0 through 11.4.0. The Core lacks tenant separation in session operations, permitting cross-tenant authorization bypass. The CVE is published, with advisory entries NVD and GitHub GHSA-j7vw-hh5c-2w6x; the disclosure does not mention any observed exploitation.

oss-securitySep 9, 14:35 UTC · 7d agoVulnerability CVE-2026-371711

Cisco Identity Services Engine Authorization Bypass Vulnerabilities

Cisco fixed authorization bypass flaws in ISE and ISE-PIC web management letting authenticated admins modify file descriptions via crafted HTTP requests.

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine and ISE Passive Identity Connector result from missing server-side validation of Administrator permissions. An authenticated remote attacker with valid Administrator credentials can submit crafted HTTP requests to modify descriptions of files on specific pages. Cisco has released software updates addressing the issues.

Cisco Security Advisories16:00 UTC · 7h agoAdvisory 15 sources