Xen XAPI compares Pool Secret with a data-dependent function (CVE-2026-102705)
XSA-529 version 2 is the public release of an issue in the bearer token that authenticates hosts in a Xen pool.
Stories per day · 30 days
6 RSS
Relatedopenjdk6java5ubuntu5passkeys4apache3authorization3biometrics3denial-of-service3jwt3sasl3account-takeover2apache-answer2iot2jaas2james2jsse2mfa2microsoft2
92 stories, newest first · one card per story
Stories tagged #authentication
OpenSSH sshole Flaw Allows Login to Passwordless Accounts
OpenSSH sshole flaw lets attackers log into password-disabled accounts using 257-1024 character passwords on musl-based systems.
1
OpenJDK 8 flaws may let remote attackers read or change data
Ubuntu cites four CVEs in Security, JSSE, and JAAS; the notice cuts off before fixes.
BioBind binds biometric deduplication to zero-knowledge authentication
A prototype rejects tested composition attacks; its unlinkable circuit uses 31,445 constraints and about 305,000 gas.
SonicWall warns of SSLVPN flaw bypassing MFA
CVE-2026-19868 in SonicOS SSLVPN allows credentialed attackers to bypass SAML and MFA when enabled; fix available in versions 7.3.4-7013 and 8.2.3-8015.
1
InfiniteWP Client NOSSL signing key recovered in 291.9 seconds
The NOSSL signing key in InfiniteWP Client 1.13.10 with 31 bits of entropy is recovered live in 291.9 seconds after permanent selection via a request parameter.
Apache James WebAdmin exposed without authentication on official Docker default (CVE-2026-74756)
WebAdmin is exposed without authentication in the official Docker image for Apache James.
Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigured (CVE-2025-66621)
SASL OAuthBearer fails to validate AUD claim in JWT payload when not configured.
OpenSSH 10.6p2 password authentication bypass via invalid hash fields
OpenSSH 10.6p2 resolves a password authentication bypass vulnerability affecting accounts with invalid password hash fields in musl libc.
LLM-Assisted Behavioral Biometric Authentication Reaches 99.46% Accuracy
LLM reasoning boosts phone-blowing biometrics to 99.46% accuracy on 50 participants.
Descope Envoy brings AI agent authentication to consumer apps
Descope Envoy supports the Personal Agent Protocol for delegating sign-in to personal AI agents alongside existing user authentication flows.
1
Node-RED authentication hole being exploited in the wild
Attackers are exploiting CVE-2026-58115 to deploy flows that download and run a Linux bot on unpatched Node-RED instances.
1
Catalyst::Plugin::Authentication before 0.10029 allows timing attacks on passwords (CVE-2026-74846)
Legacy password verifier uses eq comparisons enabling timing attacks; fixed in version 0.10029.
Passkeys stop credential theft but do not remove identity risk
A successful passkey login does not prove the account, device, or later session should still be trusted.
CDAuth Protocol Improves Efficiency in Cross-Domain Authentication
CDAuth integrates pseudo-identity, attribute concealment, and biometric hiding to reduce storage and computational costs using multi-edge servers and native group operations.
RecHash builds segmented hash-entangled chains for sequential authentication
A 256-bit digest, 32 pairs, and length 65535 yield 254 records plus a renewal certificate.
Microsoft will retire Entra ID SMS and voice sign-in in February 2027
Worldwide and GCC tenants must move telephone-only users to passkeys or another provider before February 1, 2027.
Kafka skips JWT signature checks when JWKS URL is unset (CVE-2026-110985)
DefaultJwtValidator verifies signatures only if sasl.oauthbearer.jwks.endpoint.url is set; that setting is unset by default.
Intelbras cameras allow unauthenticated firmware updates that cause DoS
A local Wi-Fi attacker can keep cameras offline by repeatedly posting to an unauthenticated upgrade endpoint; firmware R.260804 requires authentication.
1
Progressive physical-layer fingerprinting cuts Ethernet auth data
On held-out days the method cuts waveform data 75.1% and Raspberry Pi 5 CPU time 73.7% without raising error rates.
Debate over whether passkey attestation could lock out users
Critics say sites could later reject non-attested passkeys; Apple and FIDO participants say consumer attestation is not the goal.
HTTP 401 means the server rejected unproven credentials
Sucuri covers WordPress, server, and API causes, and when a sudden wave of 401s can indicate compromise.
Tomcat JNDIRealm auth fails open for non-GSSAPI SASL (CVE-2026-101296)
Apache rates the flaw important across Tomcat 7 through 11 ranges when JNDIRealm uses non-GSSAPI SASL.
Binary biometric feedback can still enable template reconstruction
A geometric attack using only accept or reject, plus a facial diffusion prior, cuts queries by about five times.