OrionLink: Privacy-enhancing SSO with oblivious identity brokers
OrionLink generates unlinkable pseudonyms and encrypted channels to shield user data from third-party SSO brokers.
Stories per day · 30 days
2 RSS
Relatedanthropic1credential-theft1email-security1federated-authentication1key-exchange1phishing1privacy-enhancing1pseudonym-derivation1
24 stories, newest first · one card per story
Stories tagged #sso
Anthropic-themed phishing emails bypass secure email gateways
Since September, an unnamed actor has used fake Anthropic previews to steal Google and Microsoft credentials.
The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
About 1,000 of 1,280 AI-embedded products bypass SSO, so inherited agents escape identity governance.
6
Legacy sign-on service comes back to bite school software provider Bromcom
Bromcom says intruders took email addresses from a legacy school SSO service, not its student MIS.
3
Legacy sign-on service comes back to bite school software provider Bromcom
Bromcom says intruders stole school SSO email addresses from a leftover legacy sign-on service.
3
12 Best SSO Solutions Compared (2026): Features & Pricing
A 2026 comparison ranks 12 SSO platforms, favoring Microsoft Entra ID for Microsoft 365 and Okta for mixed SaaS.
Top 10 Best Cloud Directory Services in 2026 [Ranked & Scored]
A 2026 ranking puts Microsoft Entra ID first among cloud directories, ahead of JumpCloud and Okta.
3
CVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party
CVE-2026-92288 allows unauthenticated OAuth2 token introspection in LemonLDAP::NG when public client secrets go unchecked.
VU#273940: Enterprise Access Management EAM does not rotate RSA keys
Imprivata EAM 26.2.6 and earlier cannot rotate its RSA key, enabling persistent impersonation after key theft.
Researchers used Claude to hack OpenAI
Researchers used Claude to chain a libheif vulnerability in Discourse with an OpenAI SSO flaw, gaining access to an internal GitHub repository.
2
Top 10 Best Single Sign-On (SSO) Solutions in 2026
Editorial buyer's guide ranks ten 2026 SSO solutions, naming Entra ID the bundled default and Okta the neutral catalog leader.
3
AI Helps Hackers Hijack OpenAI Staff Accounts Through a Forum
Hacktron researchers used Claude Opus 5 to build a libheif exploit in hours, hijacking OpenAI staff accounts via a Discourse forum shared-SSO flaw.
3
Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
Hacktron researchers used Claude Opus 5 to chain a libheif flaw and OpenAI SSO weakness, taking over staff ChatGPT and Codex accounts; OpenAI paid $6,500.
2
A heap overflow and SSO misconfiguration to compromise OpenAI internal repos
Hacktron researchers chained a libheif heap overflow in Discourse with an OpenAI SSO flaw to take over employee ChatGPT/Codex accounts and access internal repositories.
3
CISA and NIST Issue Guidance to Protect Cloud Identity Tokens
CISA and NIST published Interagency Report 8587 with voluntary guidance to harden cloud identity tokens against theft, forgery, and lateral movement.
N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security
N0va phishkit targets US and EU organizations with trusted-brand lures, capturing tokens via legitimate authentication flows to gain SSO access to corporate resources.
7
NIST Issues New Guidance to Protect SSO and API Tokens From Theft and Forgery
NIST released IR 8587 giving agencies and cloud providers recommendations to prevent identity token forgery, theft, and misuse in SSO and API environments.
1
USN-8768-1: Shibboleth vulnerability
Ubuntu patches Shibboleth SQL injection in the ODBC storage plugin allowing remote attackers to extract sensitive information.
Siemens Mendix SAML
Siemens Mendix SAML module fails signature validation, allowing unauthenticated account hijacking in specific SSO configurations (CVE-2026-80465).
New N0va Phishkit Targets North America and EU: A Growing Identity Risk for SOCs
ANY.RUN researchers uncovered the N0va phishkit targeting government, technology, consulting, and healthcare organizations across North America and the EU via device code phishing.
2
VU#889462: Casdoor authentication server is vulnerable to authorization bypass
Casdoor IAM versions 3.115.0 and earlier allow organization admins to bypass tenant isolation through inconsistent authorization checks, tracked as CVE-2026-15630.
3
Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable
Attackers actively exploit two CVSS 9.8 auth bypasses (CVE-2026-61979, CVE-2026-15981) in the miniOrange SAML WordPress plugin, forging SAML responses to become admin.
4
ShinyHunters taunts ReliaQuest after its own employee falls for social engineering attack
ShinyHunters mocked ReliaQuest after a fake-SSO social engineering call gave attackers brief view-only access to its identity dashboard via one employee.
One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin
DigitalOcean researchers reported a critical authentication flaw in miniOrange SAML SSO WordPress plugins, allowing login as WordPress admin across seven editions.