One Identity ships Active Roles 8.6 with RSTS security fix
The July 27 release supersedes 8.3 through 8.5 and adds a REST API plus SAML 2.0 token support.
Stories per day · 30 days
3 RSS
Relatedactive-directory2active-roles2ai-agents2one-identity2saml2ai-security1automotive1bilinear-cost1command-policy1consumer-trust1forge-rock1okta1rce1sybil-defense1vehicle-security1
12 stories, newest first · one card per story
Stories tagged #identity-management
Researchers Exploit ForgeRock Default Credentials to Remotely Unlock Cars
Researchers remotely accessed vehicle data and controls after RCE on production ForgeRock servers; automakers fixed the flaws in hours.
Most consumers aren’t ready to let AI agents shop unsupervised
Only 37% of North American consumers are ready for fully unsupervised AI agent actions, with willingness exceeding 50% when approvals are allowed.
1
Bilinear Sybil Cost Ensures Defense Maintains Influence Cost
Four conditions suffice for defenses to achieve bilinear Sybil cost using verifiable delay functions with A of 2 to 8.
Vinay Thakker outlines AI coding agent identity and command policies
AI agents should run under their own identity, with human identity attached for tasks for one person, using allowlist command policies and credential proxies to prevent data leaks.
Best Just-in-Time (JIT) Access Tools Compared (2026): Features & Pricing
Comparison of twelve just-in-time access tools across PAM, cloud-native, infrastructure, and governance lanes, with Microsoft Entra PIM as bundled baseline.
5
OpenID Foundation: Identity Management for Agentic AI [pdf] (2025)
OpenID Foundation white paper addresses identity management for agentic AI systems.
Apache Syncope Vulnerabilities Allow Attackers to Execute Malicious Code and Bypass Controls
Apache Syncope fixed three flaws enabling SQL injection, Groovy sandbox escape, and JWT token theft to impersonate higher-privileged users.
4
CVE-2026-87785: Apache Syncope: JWT subject spoofing
Apache Syncope disclosed low-severity CVE-2026-87785, a JWT subject spoofing flaw enabling authentication bypass in affected syncope-core-spring versions.
CVE-2026-73178: Apache Syncope: JWT Access Token takeover
Apache Syncope discloses CVE-2026-73178, an important-severity flaw enabling JWT access token takeover in versions 3.0.x through 4.1.2.
FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials
Critical FreeIPA flaw chain (CVE-2026-76578, CVSS 9.8) lets anonymous clients create reusable admin credentials on default installs; fixed in 4.13.4.
IAM Compliance Requirements and Best Practices
A guide maps IAM compliance requirements across SOX, PCI DSS, HIPAA, ISO 27001 and NIST 800-53, urging verified enforcement over documented policies.
1