The newest Authentication resources are on the Authentication page. For a reading order instead of a date order, see the Authentication learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-11-05 NEW 2026 | API-P-4: I Tested Classic API Authentication Attacks — Here’s Exactly How Hackers Break In intermediate API Sec | This article details common API authentication attack vectors. The author explores how hackers exploit vulnerabilities in traditional API authentication methods, demonstrating practical techniques. The focus is on understanding and mitigating these classic attack patterns to enhance API security. |
| 2026-11-05 NEW 2026 | PortSwigger Lab: Username enumeration via different responses intermediate Burp | This PortSwigger Lab focuses on username enumeration techniques by analyzing differing responses from a web application. Attackers can exploit variations in how the application responds to requests containing valid versus invalid usernames to identify legitimate user accounts. This information can then be used in further attack vectors. |
| 2026-11-04 NEW 2026 | Privacy aliases are not disposable email addresses intermediate 5 min read | Library for validating email addresses by distinguishing between disposable and privacy alias domains. It includes support for Apple Hide My Email, Firefox Relay, SimpleLogin, DuckDuckGo Email Protection, Fastmail Masked Email, and Proton Pass, offering a Laravel rule and Node.js function to implement this logic. The library emphasizes matching exact domains or suffixes, treating custom domains as ordinary, and using provider user IDs for cross-sign-in recognition. |
| 2026-11-04 NEW 2026 | A primer on TETRA mission-critical radio network authentication flaws beginner 8 min read | Writeup detailing TETRA mission-critical radio network authentication flaws, including CVE-2025-52944. The TETRA authentication mechanism fails to provide authenticity guarantees for messages, allowing malicious traffic injection and impersonation of legitimate ISSIs. This issue, impacting emergency services and critical infrastructure across over 100 countries, is exacerbated by optimized registration processes that skip re-authentication when radios roam between cell towers. Practical demonstrations and open-source tooling like osmocom-tetra are mentioned. |
| 2026-11-04 NEW 2026 | Pass-ta-key Golden Attack: Stealing Google Password Manager Synced Passkeys for Offline Account Takeover advanced 18 min read | Library for analyzing the "Pass-ta-key Golden Attack," which targets Google Password Manager's synced passkeys. This attack vector, identified by Unit 42, leverages malware to exfiltrate the Security Domain Secret (SDS) during device onboarding. The SDS is a master key used to encrypt all synced passkeys, allowing attackers to decrypt them and generate valid WebAuthn assertions for offline account takeover across services like Amazon, Apple, Microsoft, Binance, and GitHub. The article details the attack's methodology, focusing on SDS extraction and its implications for account security. |
| 2026-11-04 NEW 2026 | Intent Redirection to One-Click Account Takeover (But It’s a Duplicate) news Bug Bounty | A security researcher discovered an "intent redirection" vulnerability that could lead to a one-click account takeover. However, this finding was subsequently categorized as a duplicate report by the program. Therefore, while the vulnerability was identified and had the potential for severe impact, no bounty was awarded due to its duplicate status. → abdelnasserr.medium.com |
| 2026-11-04 NEW 2026 | Securing Modern Web Apps: A Hands-On Guide to OAuth 2.0 and OIDC with WSO2 Identity Server intermediate | This guide focuses on securing modern web applications using OAuth 2.0 and OpenID Connect (OIDC) with WSO2 Identity Server. It covers essential concepts like user identity, session management, and authorization flows. The content aims to provide practical, hands-on experience for developers implementing these security standards. It highlights WSO2 Identity Server as a tool for managing these complex security protocols effectively within web applications. |
| 2026-11-04 NEW 2026 | One-Click Account Takeover via WebView Auth Header Injection to Claimable Whitelisted Domain advanced Mobile | This security research details a critical vulnerability, "One-Click Account Takeover via WebView Auth Header Injection," allowing attackers to gain control of user accounts without user interaction. The exploit targets WebViews and leverages authentication header injection to compromise claimable whitelisted domains. → abdelnasserr.medium.com |
| 2026-11-04 NEW 2026 | Unauthenticated SQL Injection in Simple School Management System 1.0 — staff_delete.php news SQLi | An unauthenticated SQL injection vulnerability has been identified in the `staff_delete.php` file of Simple School Management System version 1.0. This high-severity flaw (CVSS 7.5) allows attackers to exploit CWE-89 (SQL Injection) and CWE-862 (Missing Authorization). The vendor has been notified. |
| 2026-11-04 NEW 2026 | Found critical vulnerabilities in my college ERP website – Should I report to my college or the ERP company first? beginner AuthZ | A student found critical vulnerabilities in their college's ERP website. They are unsure whether to report the issues to their college or the ERP company first. The student's intention is to responsibly disclose these findings. |
| 2026-11-03 2026 | Authentication in SaaS Applications: Building Secure Multi-Tenant Software Architecture intermediate | This content discusses the crucial role of secure authentication in multi-tenant SaaS applications. It emphasizes the need for a strong architectural foundation to manage user access and data segregation across different tenants. The article likely explores best practices for implementing authentication mechanisms that protect sensitive information while ensuring scalability and maintainability in a shared environment. Key considerations would include user identity management, authorization, and the prevention of unauthorized access within the multi-tenant architecture. |
| 2026-11-03 2026 | Using a .NET .http file to do an authentication code flow in Entra External ID (EEID) intermediate AuthZ | This content details how to perform an authentication code flow in Entra External ID (EEID) using a .NET .http file. The author provides sample .http posts to demonstrate native authentication within EEID, addressing a specific request for this functionality. The provided link contains all the necessary .http posts for implementing this flow. |
| 2026-11-03 2026 | Understanding MCP v2 Authorization with Azure Entra OBO intermediate AuthZ | This content explains how Microsoft Cloud Partner (MCP) v2 authorization works with Azure Entra's On-Behalf-Of (OBO) authentication. It highlights the adoption of OAuth 2.1 and OBO, aiming to simplify and secure the process of accessing resources on behalf of a user or service. The goal is to enhance integration and authentication capabilities within the Azure ecosystem, enabling developers to build more robust and secure applications. |
| 2026-11-03 2026 | OAuth 2.0 Without the Headache beginner AuthZ | This content introduces OAuth 2.0, a widely used authorization framework, often encountered via "Sign in with Google" or similar integrations. It simplifies the process of granting applications access to user data without sharing passwords. The article aims to explain OAuth 2.0 in a more accessible way, reducing the perceived complexity and "headache" associated with its implementation and understanding. |
| 2026-11-03 2026 | CVE-2026–92744 — Unauthenticated SYSTEM RCE in the Delinea Privilege Manager Agent news RCE | A critical remote code execution (RCE) vulnerability, CVE-2026–92744, has been identified in the Windows agent for Delinea Privilege Manager. This flaw allows for unauthenticated SYSTEM RCE, meaning an attacker can execute commands with the highest privileges on a system without needing any credentials. This poses a significant security risk as it could lead to complete system compromise. The vulnerability was recently reported by a researcher. |
| 2026-11-03 2026 | “Yeahhh ! Sign in with Google ! ”: But What Actually Happens When You Click That Easy Button ? intermediate Python | This article demystifies the "Sign in with Google" process, detailing how OAuth 2.0, OpenID Connect, and PKCE work behind the scenes. It provides a step-by-step explanation of the authentication flow, illustrating the underlying protocols that enable seamless logins. The content focuses on the technical mechanisms rather than security vulnerabilities or bug bounties. |
| 2026-11-02 2026 | PyJWT: PyJWK accepts empty HMAC keys (CVE-2026-102266) news 6 min read JWT Python | Writeup of CVE-2026-102266 in PyJWT, detailing an authentication bypass where HS256 tokens signed with an empty symmetric JWK key are accepted when verified via PyJWK or PyJWKSet. This occurs because the library inconsistently validates empty HMAC keys depending on how the key is provided, bypassing the raw-key validation checks. Applications using PyJWT versions prior to 2.13.0 with an empty oct JWK and disabled minimum key-length enforcement are vulnerable. |
| 2026-11-02 2026 | @fastify/jwt malformed time spans create never-expiring tokens (CVE-2026-107275) news JWT | A vulnerability (CVE-2026-107275) in @fastify/jwt allows for authentication bypass. Malformed time spans in JWTs can create tokens that never expire. This affects specific versions of the package. Users should consult available mitigation methods to secure their applications against this exploit. → sentinelone.com |
| 2026-11-02 2026 | Breaking JWT Validation: How JSON Nulls, Python Booleans, and Unhandled Exceptions Bypass jwcrypto intermediate AuthZ JWT Python | This article details vulnerabilities in the jwcrypto library that allow JWT validation bypass. Researchers discovered that specific inputs, including JSON nulls and Python booleans, combined with unhandled exceptions, could trick the library into accepting invalid tokens. These findings highlight critical security flaws in how JWTs are processed, potentially compromising systems relying on jwcrypto for authentication. |
| 2026-11-02 2026 | Grafana SSO settings authorization bypass, CVE-2026-103506 (CVSS 4.0 8.9) news API Sec AuthZ Secrets | A critical authorization bypass vulnerability, CVE-2026-103506 (CVSS 4.0 8.9), has been discovered in Grafana version 13.2. This flaw allows authenticated users to access sensitive Single Sign-On (SSO) client secrets and modify login configurations. The vulnerability stems from a missing permission check, potentially exposing sensitive credentials and enabling unauthorized changes to user authentication processes. |
| 2026-11-02 2026 | Simple Admin Core hardcoded JWT secret admin auth bypass writeup intermediate 7 min read JWT Secrets | Writeup of CVE-2024-XXXX, an authentication bypass in Simple Admin Core. The vulnerability stems from a hardcoded JWT secret (`jS6VKDtsJf3z1n2VKDtsJf3z1n2`) present in default configurations. Attackers can exploit this by forging JWTs with the `roleId=001` claim, granting them super-administrator privileges and full access to all system functions, including user, role, and configuration management, bypassing both authentication and authorization checks enforced by the go-zero JWT and Casbin middleware. |
| 2026-11-02 2026 | Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access news 2 min read Mobile | Writeup detailing an exploit chain combining CVE-2026-104935 (authentication bypass), CVE-2026-111357 (privilege escalation), and CVE-2026-118527 (predictable numbers) to achieve unauthenticated root-level code execution on Ivanti Connect Secure. Threat actor UTA0576 leveraged these vulnerabilities for credential theft and reconnaissance, not typical web shell deployment. CISA added the latter two CVEs to its Known Exploited Vulnerabilities catalog, mandating fixes for federal agencies. → thehackernews.com |
| 2026-11-02 2026 | Beyond Reconnaissance: Exploring Authentication and Access Control on PortSwigger Academy intermediate AuthZ | This content from PortSwigger Academy delves into authentication and access control vulnerabilities, moving beyond basic reconnaissance. It explores how to identify weaknesses in how systems verify user identities and manage their permissions. The focus is on understanding the mechanisms behind authentication and access control to uncover potential security flaws that could be exploited. |
| 2026-11-02 2026 | @fastify/oauth2 login CSRF via uncleared OAuth state cookie intermediate 1 min read CSRF | Advisory detailing GHSA-7fcr-mwg4-pw9q for `@fastify/oauth2`, which is vulnerable to Login CSRF due to the OAuth state cookie not being cleared after the callback. The vulnerability arises when cookies lack a `Path` attribute, allowing an attacker to replay a state value to hijack the user's authorization flow. Patches involve upgrading to a fixed release that sets an explicit path for cookies, or workarounds include manually setting `cookie: { path: '/' }` or using `__Host-` prefixed cookie names. |
| 2026-11-01 2026 | Authlib accepts empty HMAC key, allowing JWS/JWT forgery (CVE-2026-114616) news 3 min read JWT Python | Advisory for CVE-2026-114616 detailing how Authlib's handling of symmetric (oct) keys accepts empty HMAC keys, enabling JWS/JWT forgery. This vulnerability, similar to issues in fast-jwt and ruby-jwt, allows attackers to reproduce deterministic digests with an empty key and forge tokens, bypassing HS256/HS384/HS512 signature verification. The flaw exists in Authlib versions up to 1.7.2 due to insufficient key validation in `OctKey.import_key` and `HMACAlgorithm.prepare_key`, leading to potential authentication bypass in OAuth 2.0 resource servers and OIDC relying parties. |
| 2026-11-01 2026 | Authlib JWT bearer grant accepts assertions for wrong audience intermediate 3 min read JWT Python | Library advisory details a flaw in Authlib's default RFC 7523 JWT bearer grant where `get_audiences()` returns an empty list. This allows an attacker holding a legitimate JWT assertion for any audience to bypass audience validation in `verify_claims()` and obtain an access token from a different authorization server sharing the same signing key. This CWE-287 vulnerability can lead to unauthorized access escalation across trust boundaries, especially in microservice architectures. The exploit path involves presenting an assertion with a mismatched audience to a token endpoint that uses the default, unvalidated grant. |
| 2026-11-01 2026 | Simple Admin Core hard-coded JWT secret authentication bypass intermediate 1 min read JWT Secrets | Library for detecting authentication bypass vulnerabilities, specifically detailing how Simple Admin Core through 1.8.7 suffers from an issue allowing unauthenticated attackers to forge super administrator tokens. This bypass is achievable by exploiting the hard-coded `Auth.AccessSecret` in `api/etc/core.yaml`, enabling the signing of JWTs with a specific `roleId` claim for administrative control. The entry references related CVEs like CVE-2026-119597 and CVE-2026-113466, which also involve hard-coded keys for token forgery or authentication bypass. |
| 2026-11-01 2026 | fast-jwt RSA-to-HS256 algorithm confusion (CVE-2026-107722) news 6 min read JWT | CVE-2026-107722 details a vulnerability in nearform's fast-jwt library, affecting versions 6.2.0 through 6.2.9. This flaw allows attackers to bypass authentication or authorization by signing arbitrary HS256 claims using RSA public key material when the key has non-whitespace content before its PEM header. The misclassification occurs because the parser can incorrectly interpret RSA public keys as HMAC secrets, enabling the attack. The issue is fixed in version 6.3.0, and an asymmetric-only algorithm allowlist can prevent this vulnerability. |
| 2026-11-01 2026 | Account Takeover via CSRF on the Email-Change Endpoint ($1,300) intermediate Bug Bounty CSRF | A security researcher discovered a Cross-Site Request Forgery (CSRF) vulnerability on a platform's email-change endpoint. This flaw allowed an attacker to initiate an email change for a user without their consent, potentially leading to account takeover. The researcher was awarded **$1,300** for responsibly disclosing this critical vulnerability, which posed a significant risk to user accounts. |
| 2026-11-01 2026 | SQLi in user authentication module of Futurum Software (INCIBE-CERT) intermediate SQLi | Writeup of CVE-2026-14571, a Blind SQL Injection vulnerability in Futurum Software's user authentication module. This critical severity flaw, with a CVSS v4.0 score of 9.1, stems from insufficient input validation and improper WAF configuration, allowing unauthenticated attackers to bypass protections via manipulated HTTP requests. Exploitation can lead to arbitrary query execution, database structure extraction, and access to sensitive customer PII. |
| 2026-11-01 2026 | Authlib: unvalidated request_uri fetch in JAR leading to SSRF intermediate 3 min read JWT Python SSRF | Library advisory detailing an unvalidated `request_uri` fetch vulnerability in Authlib's RFC 9101 (JAR) extension. This flaw allows unauthenticated Server-Side Request Forgery (SSRF) by passing attacker-controlled URIs directly to a fetch hook without validation, potentially leading to requests to internal services or cloud metadata endpoints. The advisory highlights that Authlib ignores pre-existing allowlist mechanisms and its documentation encourages insecure `requests.get()` implementations, exposing deployments to SSRF and potential Denial of Service risks. |
| 2026-11-01 2026 | Wizard Takeover ATO (IDOR + CSRF) lab based on a real report intermediate 2 min read Bug Bounty CSRF IDOR | Lab recreating a $1,500 bug on YesWeHack, combining IDOR with enumerable IDs and lack of session binding with CSRF exploitation. The application's pet memorial creation wizard fails to properly validate session information, allowing an attacker to anonymously hijack memorial creation. The backend accepts a literal CSRF token, enabling control over private data and retrieval of a hidden flag. The lab covers techniques related to CWE-352, CWE-639, CWE-287, and OWASP A01:2021. |
| 2026-10-31 2026 | Github Authentication Bypass on Major CRM intermediate Bug Bounty | A significant authentication bypass vulnerability was discovered on a major CRM. This flaw allowed unauthorized access to the CRM system, posing a serious security risk. The discovery highlights potential weaknesses in authentication mechanisms of widely used customer relationship management platforms. |
| 2026-10-31 2026 | From POST-Based XSS to Full Account Takeover intermediate XSS | This content details a security vulnerability that allows for a full account takeover originating from a POST-based Cross-Site Scripting (XSS) flaw. The researcher discovered a method to exploit this XSS to gain unauthorized access and control over user accounts. |
| 2026-10-31 2026 | JWT Authentication: Structure, Attacks, and Why Weak Signature Validation Gets You Pwned intermediate API Sec JWT | This article explores JSON Web Tokens (JWTs) in authentication, detailing their structure (header, payload, signature). It highlights common attacks, particularly focusing on vulnerabilities arising from weak signature validation. Attackers exploit these weaknesses to forge tokens, bypass authentication, and gain unauthorized access. The piece emphasizes the critical importance of robust signature verification to maintain secure JWT-based authentication systems. |
| 2026-10-31 2026 | Gradle: deserialization of untrusted Java objects before authentication intermediate 2 min read Deser RCE | Library advisory GHSA-xwqc-3h47-hg64 details a deserialization vulnerability in Gradle's client-daemon communication. An attacker with local access can exploit this by sending crafted Java serialized objects before authentication, leading to remote code execution or denial of service within the daemon JVM. The vulnerability, which requires a Gradle daemon to be running, impacts builds on shared or multi-user systems. Gradle has patched the issue by verifying the secret token before deserializing untrusted input, aligning with internal guidance to avoid Java serialization. |
| 2026-10-31 2026 | Critical Account Takeover via CSRF Header Bypass intermediate CSRF | This report details a critical security vulnerability allowing for account takeover through a Cross-Site Request Forgery (CSRF) bypass. The exploit leverages manipulation of CSRF headers to gain unauthorized access to user accounts. |
| 2026-10-31 2026 | Eight Doors, One Key: Chaining Misconfigurations into Full Account Takeover intermediate CSRF | This write-up details how an attacker achieved full account takeover on a seemingly secure application by chaining together multiple misconfigurations. Despite robust security measures like CSRF tokens, SameSite cookies, strict CORS, and a WAF, the vulnerability was exploited through a single HTML injection. The attacker leveraged a chain of weaknesses, ultimately leading to complete control over user accounts. |
| 2026-10-31 2026 | Lab2: Host header authentication bypass — HTTP Host header attacks intermediate Burp | This lab focuses on HTTP Host header attacks, specifically demonstrating how to bypass authentication by manipulating the Host header. Attackers can exploit vulnerabilities where applications rely on the Host header for security checks. By submitting a crafted Host header, an attacker might trick the application into granting unauthorized access or revealing sensitive information. The lab provides a practical environment to understand and practice these types of attacks. |
| 2026-10-31 2026 | Unauthenticated SQLi in a GraphQL API: From Guest to Admin Takeover intermediate API Sec GraphQL SQLi | This report details a critical vulnerability found in a GraphQL API, allowing unauthenticated SQL injection. Attackers could exploit this flaw to escalate their privileges from a guest user to an administrator. The SQL injection allowed for arbitrary data retrieval and modification, ultimately leading to a full account takeover. The findings highlight the importance of robust input validation and secure coding practices even for seemingly less privileged API endpoints. The report provides detailed steps for reproduction and remediation. |
| 2026-10-31 2026 | One Payload, Four Targets: How a 10% Confidence Scanner Hit Unlocked Unauthenticated… intermediate XSS | A security researcher discovered a reflected XSS vulnerability exploitable with a single payload. This vulnerability bypassed authentication and affected four distinct targets within an application fleet. The exploit was found using a scanner with only 10% confidence, highlighting its ability to uncover critical flaws. The postmortem delves into the technical details of this unauthenticated JavaScript-context XSS. |
| 2026-10-31 2026 | From Out of Scope XSS to Account Takeover: The Iframe Sandwich (OWASP talk) intermediate Bug Bounty Talks XSS | This OWASP AppSec Days Portugal 2026 talk, "The Iframe Sandwich," by Dinis Costa, explores a vulnerability that allows attackers to escalate an "out-of-scope" Cross-Site Scripting (XSS) flaw into a full account takeover. The presentation likely details the exploit chain, using iframes in a novel way to bypass security measures and gain unauthorized access to user accounts. |
| 2026-10-31 2026 | IDOR in Munshi: Changing a Purchase Inquiry ID Exposed Another User’s Thread intermediate AuthZ IDOR | An Insecure Direct Object Reference (IDOR) vulnerability was discovered in the Munshi application. This flaw allowed an authenticated user to access and view another user's purchase inquiry by manipulating the inquiry ID. Consequently, this exposed sensitive thread information belonging to different users. |
| 2026-10-30 2026 | XML Signature Wrapping authentication bypass in Moldova's MPass SAML NuGet library, fixed in 10.0.4 (CVE requested, CAN-2026-2041077) news | A critical XML Signature Wrapping authentication bypass vulnerability has been discovered in Moldova's MPass SAML NuGet library. This flaw, identified by CVE request CAN-2026-2041077, allows attackers to bypass authentication mechanisms. The issue has been addressed and fixed in version 10.0.4 of the library. |
| 2026-10-25 2026 | Show HN: Steal My Bitcoin intermediate AuthZ Bug Bounty | The "Steal My Bitcoin" project presents a challenge where users can attempt to exploit vulnerabilities to steal a designated amount of Bitcoin. The primary goal is to test and demonstrate security weaknesses within a controlled environment. This initiative serves as a public demonstration of potential attack vectors and a call for security researchers to identify and report flaws. |
| 2026-10-23 2026 | The Current Landscape of OAuth Attacks intermediate 14 min read | Analysis of OAuth attacks details evolving adversary tactics targeting authorization tokens rather than credentials. These attacks bypass multi-factor authentication (MFA), providing persistent access and enabling account takeover, lateral movement, and data exfiltration. Specific vulnerabilities include Cross-User OAuth Session Fixation (COSF), Cross-Tenant Client ID Confusion, and Cross-Connector OAuth Account Takeover, often exacerbated by long-lived tokens. Defenses involve disabling end-user app consent, enforcing admin approval workflows, monitoring authorization code clipboard events, and auditing redirect URIs. → unit42.paloaltonetworks.com |
| 2026-10-21 2026 | From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage news 5 min read AI | Analysis of "LLMjacking" campaigns reveals threat actors targeting Google Cloud billing accounts for unauthorized AI usage. These attacks begin with phishing for GCP credentials, leading to policy manipulation and the addition of external attacker-controlled Gmail accounts to the victim's billing account. The threat actors then link foreign GCP projects, directing AI workload costs to the victim while keeping prompt content hidden. This results in rapid billing surges, often reaching hundreds of thousands of dollars, due to mass Gemini API utilization. → wiz.io |
| 2026-10-08 2026 | CVE-2026-102489 Deep-Dive: Zammad Session Leak to RCE advanced 3 min read RCE | Writeup on CVE-2026-102489, a Zammad session hijack leading to RCE. This vulnerability, disclosed by DIVD, abuses a WebSocket endpoint (`/ws`) with a simple payload (`{"event": "base"}`) to trigger an error that leaks all active user session cookies within the application's logs. An attacker can leverage a leaked admin session cookie to write malicious ERB templates via the package installation endpoint. Initiating a password reset then renders this template, achieving remote code execution as the `zammad` OS user. → horizon3.ai |
| 2026-10-06 2026 | Smashing the token limit with overlapping fragments advanced 7 min read JWT | Library for exfiltrating large tokens using overlapping CSS fragments. This technique reconstructs tokens by stitching together smaller identified CSS chunks from a given URL. It optimizes token extraction efficiency by strategically employing two-character, three-character, four-character, and five-character checks to minimize CSS payload size, achieving token lengths of 210 hex characters with a single candidate and up to 640 characters with multiple candidates. → portswigger.net |
| 2026-10-02 2026 | From: anyone@icloud.com - Spoofing Arbitrary Apple iCloud Identities advanced 1 min read | Writeup detailing header smuggling vulnerabilities discovered in Apple iCloud's email infrastructure. This technique, building on lessons from SMTP smuggling, allows for spoofing emails from arbitrary `@icloud.com` addresses by exploiting parsing discrepancies within Apple's SMTP implementation. The research highlights the continued risks of email trust due to these SMTP parsing vulnerabilities, even after widespread fixes for traditional SMTP smuggling. |