Identity, Auth & Access

11+ hour, 3+ min ago   (158+ words) New York, New York, October 6th, 2026, CyberNewswire Purpose-built for AI agents, new capabilities uncover shadow AI, stop rogue enterprise agents at runtime, and issue quantum-resilient agent identities This release of Agent Identity Security is the latest proof point of AppViewX’s broader…...

15+ hour, 58+ min ago   (703+ words) Last Tuesday, a staging auth bug had three devs stumped for half an afternoon. The expiration was hours away. The role string was right. So why did the API gateway reject it? Because Base64URL decoding doesn’t verify signatures. It just prints…...

19+ hour, 22+ min ago   (886+ words) A patched authentication bypass is easier to ignore than an unpatched one. WSO2 fixed CVE-2026-5430 in April 2026, published an advisory in May, and saw exploitation in the wild in September after CISA added it to the KEV catalog. The flaw, a…...

23+ hour, 49+ min ago   (303+ words) The previous article covered how REST API requests inside wp-admin are protected by a combination of cookies and nonces. This time we go one level deeper: what actually happens when you "log in," and why does entering a password once…...

6+ day, 6+ hour ago   (672+ words) A lot ships across the identity platform every month, and most of it lands in the release notes and then quietly disappears. That’s a shame, because some of those changes genuinely move how you manage machine and agentic identity. This…...

1+ day, 12+ hour ago   (54+ words) Seven critical flaws in the open-source identity provider let unauthenticated attackers hijack accounts, bypass MFA, and cross organization boundaries — and the EOL 3.x branch will never be patched. Heath Callahan Trust, Identity & Security All stories by Heath Callahan → |[email protected] Heath…...

1+ day, 7+ hour ago   (44+ words) LAB NAME:Continue reading on Medium » JWT Authentication Bypass via Algorithm Confusion — PortSwigger Lab Walkthrough What is Algorithm Confusion? Written by Deepak Kumar “B.Tech student in web security & bug bounty. Documenting labs, CTFs & case studies to share knowledge and…...

1+ day, 23+ hour ago   (1509+ words) WordPress's REST API (covered in an earlier article) mixes two kinds of endpoints: some that anyone can read without authenticating, and others that reject you outright unless you're logged in. Inside wp-admin, the browser is quietly firing off requests to…...

2+ day, 1+ hour ago   (1402+ words) When engineering teams scale distributed cloud services in highly regulated sectors like healthcare, traditional perimeter defense completely collapses. Developers need rapid access to packages, continuous integration, and staging environments, while security leads must guarantee that electronic Protected Health Information (ePHI)…...

2+ day, 2+ hour ago   (188+ words) The “quick and easy” authentication setup that almost cost us our entire user base. We needed to add Google login to our SaaS application. The marketing team was pushing hard — “users want one-click signup!” — and I wanted to ship it…...