The newest Authentication resources are on the Authentication page. For a reading order instead of a date order, see the Authentication learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-06-22 2026 | Common SAML vulnerabilities and how to remediate them beginner 4 min read | Reference detailing common SAML vulnerabilities and their remediation, including signature validation to prevent XML tampering and XML signature wrapping, weak encryption of assertions, and message expiration using "NotBefore" and "NotOnOrAfter" to prevent replay attacks. It also addresses open redirect vulnerabilities exploitable via the "RelayState" parameter and suggests ensuring its value is a trusted URL before redirection, referencing `samlify` and `python3-saml` libraries. → snyk.io |
| 2026-06-20 2026 | Emerging phishing campaign targeting AWS accounts news 4 min read | Writeup on an emerging phishing campaign targeting AWS accounts, detailing its use of redirect chains via services like squarespace.com and cli.re to reach credential harvesting pages, often visually cloning the legitimate AWS sign-in page. The campaign leverages Amazon SES and CloudFront, with observed attacker-controlled domains including consoleportal[.]tech. It emphasizes securing AWS environments by disabling root logins via SCP, using FIDO security keys for MFA, enforcing SSO, implementing least privilege, and enabling Amazon CloudTrail for logging and impact assessment. → wiz.io |
| 2026-06-20 2026 | AWS Console Session Traceability: How Attackers Obfuscate Identity Through the AWS Console intermediate 8 min read | Writeup on the "Console Conceal" technique, which attackers can use to obfuscate their identity within AWS by manipulating role session names and exploiting a quirk in how AWS Console actions are logged in CloudTrail. This method bypasses standard traceability, making it difficult to attribute actions back to compromised credentials, especially when SourceIdentity is not configured. The analysis details how attackers can assume roles with misleading session names and how security teams can still investigate by correlating actions with the original AssumeRole events. → wiz.io |
| 2026-06-20 2026 | “Bug Bounty Bootcamp #48: OAuth + XSS ” intermediate Bug Bounty XSS | This Bug Bounty Bootcamp #48 focuses on a potent combination for account takeover: OAuth vulnerabilities and Cross-Site Scripting (XSS). The article, "The Ultimate Account Takeover One-Two Punch," explores how these two attack vectors can be exploited in tandem to gain unauthorized access to user accounts. The content is hosted on InfoSec Write-ups and details the methods and techniques used in such exploits. → infosecwriteups.com |
| 2026-06-19 2026 | “Bug Bounty Bootcamp #46: Not Allowed From Your IP?” advanced | This article from InfoSec Write-ups, "Bug Bounty Bootcamp #46: Not Allowed From Your IP?", details advanced techniques for bypassing authentication barriers in bug bounty hunting. The methods discussed include IP spoofing, brute-force attacks, and mass assignment, all aimed at gaining unauthorized access. The focus is on exploiting authentication vulnerabilities to overcome access restrictions. → infosecwriteups.com |
| 2026-06-18 2026 | The many ways to obtain credentials in AWS beginner 5 min read Secrets | Library detailing numerous methods for attackers to obtain AWS credentials, beyond the typical IMDSv2 requests to 169.254.169.254. It covers AWS SDK credential providers, IAM user access keys, environment variables in Lambda, EC2 user-data, credential files, IMDSv1 and IMDSv2, container services like ECS and EKS (including EKS Pod Identities, IRSA), Default Host Management Configuration (DHMC), Systems Manager hybrid activation, AWS IoT's iot:AssumeRoleWithCertificate, IAM Roles Anywhere, Cognito's GetCredentialsForIdentity, and DataSync's certificate-based authentication. → wiz.io |
| 2026-06-18 2026 | Avoiding mistakes with AWS OIDC integration conditions intermediate 6 min read | Library documenting mistakes in AWS OIDC integration conditions, highlighting issues with GitHub Actions, Terraform Cloud, Microsoft Defender, and GitLab. It emphasizes the importance of specific IAM trust policy conditions like "sub" and "sts:RoleSessionName" to prevent unauthorized access, detailing variations across over twenty vendors and built-in AWS identity providers, and advises ensuring both "aud" and "sub" conditions when available. → wiz.io |
| 2026-06-17 2026 | 27 Years in the Dark: OpenBSD Fixes Ancient Remote Kernel Auth Bypass news 3 min read | Library for OpenBSD's sppp(4) subsystem that addresses a 27-year-old remote kernel authentication bypass vulnerability (CVE-2026-55706) in the Password Authentication Protocol (PAP). The bug allowed unauthenticated access by exploiting how length fields were handled in `bcmp` calls, leading to both authentication bypass and kernel heap over-reads. The fix introduces an exact-length pre-check for credentials, mirroring the CHAP handler, ensuring proper validation. |
| 2026-06-17 2026 | Bug Bounty Bootcamp #45: Token? intermediate API Sec | This Bug Bounty Bootcamp #45 focuses on a vulnerability where a password reset mechanism leaks a "magic token" in the API response. The content also mentions an even more problematic endpoint that provides this token directly. The article's title suggests this is a critical finding relevant to bug bounty hunting. → infosecwriteups.com |
| 2026-06-14 2026 | From Compromised Keys to Phishing Campaigns: Inside a Cloud Email Service Takeover intermediate 7 min read Secrets | Library detailing a cloud email service takeover campaign that leveraged compromised AWS access keys. Attackers bypassed Amazon SES sandbox restrictions by using a novel, multi-regional `PutAccountDetails` request to gain production mode access, subsequently verifying attacker-owned and weakly protected legitimate domains to launch phishing operations targeting tax forms. The campaign utilized a commercial traffic analysis service for redirection to evade detection and facilitate credential theft, highlighting the risks of SES abuse including reputational damage and potential for broader compromise. → wiz.io |
| 2026-06-13 2026 | Major AI Clients Shipping With Broken OAuth Implementations (JUNE 2026 UPDATE) news 4 min read API Sec | Reference detailing OAuth refresh token implementation issues in major AI clients like Cursor, Claude, and VS Code, as per the MCP authorization specification and SEP-2207. It highlights failures in metadata discovery for Claude Code and incomplete support across clients, noting the workaround solution provided by the `mcp-remote` tool. |
| 2026-06-13 2026 | I Simulated an SSH Brute-Force Attack on My Ubuntu Server — Here’s How Fail2Ban Stopped It intermediate | The author details setting up an attack lab to simulate SSH brute-force attempts against their Ubuntu server. The primary focus is on observing how Fail2Ban functions to detect and automatically block repeated failed login sequences. The article aims to provide a practical understanding of Fail2Ban's effectiveness in protecting against such attacks. → infosecwriteups.com |
| 2026-06-13 2026 | Beyond the Patch: Understanding the SonicWall SSL-VPN MFA Bypass Exposure news | A SonicWall SSL-VPN vulnerability, CVE-2024–12802, allows attackers to bypass Multi-Factor Authentication (MFA). The flaw lies in how SSL-VPN handles UPN and SAM account formats separately. Attackers can exploit alternative login formats to circumvent MFA, even when it seems active. This issue affects SonicWall Gen6 SSL-VPN devices and has been linked to ransomware attacks. → infosecwriteups.com |
| 2026-06-12 2026 | Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751) - watchTowr Labs news 11 min read RCE | Writeup of CVE-2026-50751, a Check Point Remote Access VPN authentication bypass, details a logic flaw in IKEv1 certificate validation. The vulnerability, present in various Gaia versions, allowed attackers to bypass signature verification by manipulating a `process_machine_certs` parameter and a `peer_flags` bit, preventing the gateway from properly authenticating clients. Exploited in the wild by threat actors including Qilin ransomware affiliates, the issue was patched by Check Point in subsequent hotfixes. → labs.watchtowr.com |
| 2026-06-12 2026 | 3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs intermediate 10 min read JWT | Library for detecting OAuth TTPs in Azure environments. It details device code phishing, where attackers exploit the device code flow to trick victims into authenticating with MFA, granting the attacker a token. It also covers Resource Owner Password Credentials (ROPC) abuse, leveraging legacy flows without MFA or browser consent for credential stuffing and persistence, often targeting applications like Azure AD PowerShell. Finally, it explains how attackers can use specific token-resource combinations, such as Microsoft Authentication Broker and Intune Enrollment, to register a device and bypass Conditional Access policies. KQL queries are provided for log analysis. → wiz.io |
| 2026-06-11 2026 | Authentication issues related to API requests beginner API Sec | This content highlights authentication problems that can occur with API requests. These issues can compromise the security and integrity of data transmitted through APIs. Without proper authentication, unauthorized users could potentially access sensitive information or perform actions they are not permitted to do. The focus is on identifying and addressing these vulnerabilities to ensure secure API communication. |
| 2026-06-11 2026 | Would You Click ‘Accept’? Automatically detecting malicious Azure OAuth applications using LLMs intermediate 11 min read AI | Library for detecting malicious Azure OAuth applications by analyzing campaigns, identifying homoglyph attacks, and flagging deviations from legitimate integrations like publisher verification status, homepage URLs, and owning tenant domains. This tool helps identify stealthy threats that blend with legitimate business integrations, preventing unauthorized access and privilege escalation. → wiz.io |
| 2026-06-11 2026 | 10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums news 2 min read RCE | Tool for discovering critical Authentication Bypass vulnerabilities in phpBB. Aikido Attack identified a flaw affecting versions up to 3.3.16 and 4.0.0-a2, allowing unauthenticated users to gain valid sessions and impersonate any user, including administrators. This vulnerability, reported via HackerOne, led to a swift patch in phpBB version 3.3.17. → aikido.dev |
| 2026-06-11 2026 | You Can't Secure What You Can't See: Making Non-Human Identities Governable beginner 4 min read Secrets | Library for governing non-human identities (NHIs), it provides a centralized, searchable view of NHIs across infrastructure, surfacing origin, path, environment, risk level, and ownership status. This enables continuous governance by allowing teams to review changes, spot drift early, and prioritize remediation. It identifies risky patterns such as public leaks, cross-environment secrets, reused credentials, long-lived secrets, and overprivileged identities, offering context through an exploration map to understand dependencies before taking action like revoking or rotating credentials. → blog.gitguardian.com |
| 2026-06-10 2026 | Volkswagen blocks Home Assistant by requiring client assertion news 1 min read | Library issue detailing how Volkswagen blocked Home Assistant integration by requiring client assertion. The issue stems from Volkswagen's identity provider at `identity.vwgroup.io/oidc/v1/authorize`, which now rejects requests with `response_type=code token id_token`, preventing the library from obtaining necessary access tokens. This blocks login functionality for users. |
| 2026-06-10 2026 | ServiceNow's Virtual Agent Vulnerability Shows Why AI Security Needs Traditional AppSec Foundations beginner 6 min read AI AuthZ | Library for identifying and mitigating vulnerabilities in AI agents, such as the ServiceNow Virtual Agent exploit. This resource highlights that securing AI requires foundational application security practices, including threat modeling for agent behavior, Dynamic Application Security Testing (DAST) to detect hardcoded secrets and authorization flaws, and AI red teaming to uncover the impact of autonomous agent actions. It emphasizes a layered security approach, auditing agent permissions, enforcing strong API authentication, and implementing continuous testing. → snyk.io |
| 2026-06-10 2026 | SQL Injection in Password Reset: Full Database, One Email intermediate SQLi | A SQL injection vulnerability in a password reset feature granted a researcher full read access to the entire database. By manipulating a "ukey" parameter in the password reset link, the attacker could retrieve all user records, including plaintext password hashes. The vulnerability was reported in early 2025 and remained unpatched. → infosecwriteups.com |
| 2026-06-09 2026 | Context.ai OAuth Token Compromise news 4 min read Supply Chain | Analysis of the Context.ai OAuth token compromise details a supply chain attack vector where compromised tokens for a third-party AI tool allowed attackers access to Vercel's Google Workspace. This incident highlights the risks associated with broad OAuth permissions and trusted SaaS integrations, similar to prior attacks like the Salesloft Drift incident and the Midnight Blizzard campaign. The analysis provides guidance on revoking access, rotating credentials, and investigating account activity across Google Workspace, Azure AD, and Okta. → wiz.io |
| 2026-06-08 2026 | Detecting CVE-2026-0265 at Scale: PAN-OS CAS Authentication Bypass news 8 min read JWT | Tool for detecting CVE-2026-0265, a pre-authentication JWT signature bypass in PAN-OS and Panorama. The vulnerability, exploitable when Cloud Authentication Service (CAS) is attached to an authentication profile, affects both GlobalProtect portals and the management interface. This detection script utilizes a single anonymous HTTP request to the `/global-protect/prelogin.esp` endpoint to definitively determine a system's vulnerable or non-vulnerable status, by examining the presence of `<cas-auth>yes</cas-auth>` and extracting the authoritative PAN-OS version from an embedded JWT. → bishopfox.com |
| 2026-04-22 2026 | CVE-2026-2092: Keycloak Auth Bypass Vulnerability news 4 min read | Writeup of CVE-2026-2092, a Keycloak authentication bypass vulnerability, details how attackers can inject encrypted assertions into unsigned SAML responses. This flaw, affecting Keycloak and related Red Hat products, allows unauthorized access by substituting an attacker's valid signed assertion with one for an arbitrary principal, bypassing proper validation and potentially compromising identity federation. Mitigation involves applying patches and configuring SAML identity providers to always sign SAML responses in addition to assertions. → sentinelone.com |
| 2026-04-22 2026 | CVE-2026-1529: Bypassing Keycloak Org Security news 4 min read | Writeup of CVE-2026-1529, a critical bypass in Keycloak's Organizations feature, details how attackers can forge JWT invitation tokens by omitting signature verification. This vulnerability, with a CVSS score of 8.1, allows unauthorized access to restricted organizations by simply modifying the organization ID within a valid invite token. The report covers the exploit technique, the impact on multi-tenancy, and remediation steps including immediate updates to Keycloak versions 26.x or disabling the Organizations feature. |
| 2026-04-22 2026 | CVE-2025-26788: Passkey Authentication Bypass in StrongKey FIDO Server news 3 min read | Writeup of CVE-2025-26788, a passkey authentication bypass in StrongKey FIDO Server versions 4.10.0 through 4.15.0. This vulnerability allows account takeover by exploiting a flaw where the server fails to distinguish between discoverable and non-discoverable credential flows, enabling an attacker to use their own passkey with a victim's username. The writeup includes a proof-of-concept demonstrating the attack and recommends updating to StrongKey FIDO Server version 4.15.1. |
| 2026-04-22 2026 | Analyzing the rise in device code phishing attacks in 2026 news 12 min read | Analysis of device code phishing attacks highlights a significant rise in this account takeover technique since 2026, exploiting the OAuth 2.0 Device Authorization Grant. Attackers leverage this flow, commonly used by CLI tools, to trick users into issuing access tokens to malicious applications, bypassing passwords, MFA, and passkeys. Prominent targets include Microsoft, Google, Salesforce, GitHub, and AWS. The "EvilTokens" PhaaS kit has been identified as a major driver of these campaigns, offering sophisticated anti-bot measures and user-friendly interfaces. Research has traced the evolution of these kits, noting advancements in hosting, code generation, and payload delivery methods. |
| 2026-04-22 2026 | SAML rough quarter: Five critical vulnerabilities in four months news 9 min read | Library of resources detailing critical SAML vulnerabilities, including CVE-2026-3055 in Citrix NetScaler, "The Fragile Lock" research by PortSwigger (CVE-2025-66568, CVE-2025-66567) revealing parser-level bypasses, CVE-2026-25922 in authentik for assertion injection, CVE-2026-34840 in OneUptime for auth bypass due to signature verification decoupling, and CVE-2026-20101 in Cisco Secure Firewall leading to DoS. These highlight systemic issues in SAML XML processing and signature validation. |
| 2026-04-22 2026 | CVE-2024-9956: Critical WebAuthentication Vulnerability in Chrome on Android news 3 min read | Writeup of CVE-2024-9956 details a critical flaw in Google Chrome on Android, allowing local attackers within Bluetooth range to steal PassKeys via crafted HTML pages. This vulnerability, impacting WebAuthn's FIDO:/ URI scheme handling, could lead to account takeovers across various browsers like Safari on iOS and Firefox on Android. The exploit involves tricking users into visiting malicious sites that silently trigger Bluetooth-based authentication requests, enabling attackers to intercept credentials and gain unauthorized access. Mitigation includes updating Chrome, disabling WebAuthn via Bluetooth, and exercising caution with links. |
| 2026-04-22 2026 | CVE-2026-34457 Detail (OAuth2 Proxy) - NVD news 1 min read | Writeup detailing CVE-2026-34457, an authentication bypass vulnerability in OAuth2 Proxy affecting versions prior to 7.15.2. This flaw occurs in specific configurations using auth_request-style integrations with either `--ping-user-agent` or `--gcp-healthchecks` enabled, allowing unauthenticated attackers to access protected resources by mimicking the health check User-Agent. The vulnerability is categorized under CWE-290: Authentication Bypass by Spoofing. |
| 2026-04-19 2026 | Bypassing MFA with OAuth Abuse: Pentesting SSO Flows intermediate 4 min read | Library for exploiting OAuth misconfigurations, focusing on bypassing Multi-Factor Authentication (MFA) in Single Sign-On (SSO) flows. It details techniques for token reuse, session fixation, open redirect vulnerabilities, and improper scope enforcement, guiding users through tools such as OAuth2 Proxy, mitmproxy, Evilginx, and OauthTester to identify and exploit these weaknesses. |
| 2026-04-19 2026 | SSO Protocol Security: Critical Vulnerabilities in SAML, OAuth, OIDC, JWT (2025) advanced 24 min read | Library cataloging SAML, OAuth, OIDC, and JWT vulnerabilities, including XML Signature Wrapping attacks affecting Ruby SAML (CVE-2024-45409) and GitHub Enterprise Server (CVE-2024-6800), XML canonicalization bugs in various libraries (CVE-2017-11427 to CVE-2017-11430, CVE-2018-0489), assertion replay issues (CVE-2018-14637), and vendor-specific flaws like Oracle Access Manager (CVE-2021-35587). The analysis highlights recurring authentication bypasses and token forgery risks, emphasizing the impact and exploitability of these critical SSO protocol weaknesses. |
| 2026-04-19 2026 | The Art of Breaking OAuth: Real-World Exploits and Misuses intermediate | The Art of Breaking OAuth: Real-World Exploits and Misuses → infosecwriteups.com |
| 2026-04-19 2026 | OAuth2-Proxy Authentication Bypass (CVE-2025-54576) news 3 min read | Writeup detailing CVE-2025-54576, an authentication bypass vulnerability in OAuth2-Proxy versions 7.10.0 and below. The flaw lies in the `skip_auth_routes` configuration, where regex patterns intended for paths were incorrectly applied to the entire request URI, including query parameters. This allowed attackers to craft URLs with malicious query strings to bypass authentication. The fix, implemented in version 7.11.0, restricts pattern matching to only the request path. → zeropath.com |
| 2026-04-19 2026 | OAuth SSO WordPress Plugin JWT Bypass (CVE-2025-9485) news 2 min read | Writeup of CVE-2025-9485, a JWT bypass vulnerability in miniOrange's OAuth Single Sign On – SSO (OAuth Client) WordPress plugin. Versions up to and including 6.26.12 improperly verify JWT signatures, allowing attackers to forge tokens and gain administrator access by manipulating the `sub` claim. This flaw, classified as CWE-347, affects thousands of sites using the plugin for integration with providers like Azure AD and Google Workspace. → zeropath.com |
| 2026-04-17 2026 | What is WebAuthn Standard? Guide to WebAuthn Protocol & API beginner 4 min read | Library detailing the Web Authentication (WebAuthn) standard, a passwordless login API developed by the FIDO Alliance and W3C. WebAuthn uses public-key cryptography, supported by protocols like CTAP, to facilitate secure communication between browsers and authenticators, eliminating reliance on passwords. It integrates with major browsers and companies like Google, Microsoft, and Apple, and is foundational for passkeys, while distinct from authorization protocols like OAuth. |
| 2026-04-17 2026 | Navigating the New Wave of MFA Bypass Attacks in 2025 intermediate 3 min read | Technique analysis detailing prevalent MFA bypass methods in 2025, including prompt bombing, social engineering, and session hijacking. It highlights mitigation strategies such as number matching, restricted requests, IT support verification protocols, secure cookie attributes, and EDR deployment. The entry also recommends phishing-resistant authentication solutions like virtual passkeys, FIDO2 hardware keys (YubiKey, Google Titan), biometrics, risk-based adaptive MFA, and certificate-based authentication. |
| 2026-04-17 2026 | Broken authentication: 7 Advanced ways of bypassing 2-FA (Intigriti) intermediate 7 min read | Library detailing seven advanced methods for bypassing two-factor authentication (2FA) implementations. It covers techniques such as forced browsing, bruteforcing with tools like BurpSuite, exploiting weak or re-usable 2FA tokens, and leveraging vulnerabilities like CSRF, IDOR, and flawed password reset functionalities, including second-order bypasses via path traversal. → intigriti.com |
| 2026-04-17 2026 | Vulnerabilities in multi-factor authentication (PortSwigger) intermediate 4 min read | Reference on multi-factor authentication vulnerabilities, detailing bypass techniques against two-factor authentication (2FA) and multi-factor authentication (MFA). It covers flaws such as skipping the second authentication step, insecure verification logic allowing cookie manipulation, and the risks associated with SMS-based verification codes and SIM swapping. The reference also discusses brute-forcing verification codes and highlights extensions like Burp's Turbo Intruder for exploitation. → portswigger.net |
| 2026-04-17 2026 | Two-Factor Authentication (2FA): Bypass Scenarios (DeepStrike) intermediate 9 min read | Writeup detailing nine real-world scenarios for bypassing two-factor authentication (2FA), including force-browsing to skip checks, code leakage via responses or JavaScript, brute-forcing OTPs with weak rate limits, insecure recovery flows, backup code abuse, CSRF to disable 2FA, weak remember-me tokens, forgotten subdomains, and OAuth/account-linking pitfalls. Each scenario covers the vulnerability, testing methodology, and remediation strategies. |
| 2026-04-17 2026 | Hacking SAML - Vickie Li intermediate | Hacking SAML - Vickie Li |
| 2026-04-17 2026 | SSO Bypass: How Attackers Circumvent Single Sign-On (Obsidian) intermediate 8 min read | Library detailing techniques attackers use to circumvent Single Sign-On (SSO) authentication. This includes vulnerabilities like Golden SAML, which allows forging cryptographically indistinguishable SAML tokens, and SAML signature bypasses that exploit improper validation in service providers, as seen in CVE-2025-47949 and CVE-2024-45409. The analysis also covers XML signature wrapping attacks, token replay, fallback local authentication mechanisms, and direct identity provider compromises, such as the MGM breach via social engineering. |
| 2026-04-17 2026 | CVE-2020-2021 PAN-OS: Authentication Bypass in SAML news 5 min read | Writeup on CVE-2020-2021, detailing an authentication bypass vulnerability in PAN-OS SAML authentication. When the 'Validate Identity Provider Certificate' option is disabled, an unauthenticated network attacker can gain access to protected resources like GlobalProtect, web interfaces, and Prisma Access. The critical severity vulnerability, with a CVSS score of 10.0, affects various PAN-OS versions prior to specific fixes and can be mitigated by ensuring the identity provider certificate is configured and validated. |
| 2026-04-17 2026 | HackerOne Report #812064: SAML authentication bypass (Rocket.Chat) news | HackerOne Report #812064: SAML authentication bypass (Rocket.Chat) → hackerone.com |
| 2026-04-17 2026 | SAML Security (OWASP Cheat Sheet) beginner 18 min read | Cheatsheet detailing Security Assertion Markup Language (SAML) security, focusing on the Web Browser SSO Profile with Redirect/POST bindings. It addresses message confidentiality and integrity via TLS 1.2, digital signatures, and XML encryption to counter eavesdropping, theft, and modification. The guide emphasizes validating protocol usage, referencing the Google SSO vulnerability, and securing signatures against XML Signature Wrapping attacks. It also covers binding implementations, security countermeasures like IP filtering and short lifetimes, and considerations for unsolicited responses and IdP-initiated SSO, identifying attacks such as Man-in-the-middle, Stolen Assertion, and Replay. → cheatsheetseries.owasp.org |
| 2026-04-17 2026 | Fun with SAML SSO vulnerabilities and footguns (WorkOS) intermediate 13 min read | Guide to SAML SSO vulnerabilities and footguns, detailing common security pitfalls in XML-based authentication. It covers risks like GitLab, IBM Data Risk Manager, Mattermost, and PAN-OS SAML vulnerabilities, and recommends countermeasures including limiting SAML payload size, disabling remote DTD loading, and validating SAML response schemas to prevent attacks like XML Signature Wrapping. |
| 2026-04-17 2026 | OAuth 2.0 Common Security Flaws and Prevention (APIsec) beginner 4 min read | Library detailing OAuth 2.0 security flaws and prevention, including redirect URI manipulation, CSRF attacks via missing state parameters, authorization code interception, PKCE downgrade attacks, insecure token storage, credential leakage through URLs, and misuse of OAuth for authentication. It advocates for adopting OAuth 2.1 standards, implementing sender-constrained tokens like DPoP, using well-reviewed libraries, and continuous security testing to mitigate vulnerabilities like those seen in the July 2025 Allianz Life Salesforce breach. |
| 2026-04-17 2026 | Top 10 OAuth 2.0 Hacking Techniques Part 2 intermediate | Top 10 OAuth 2.0 Hacking Techniques Part 2 |
| 2026-04-17 2026 | Vulnerable-OAuth-2.0-Applications (GitHub) beginner 6 min read API Sec | Library demonstrating common security pitfalls in OAuth 2.0 implementations for Classic Web Applications, Single Page Applications, and Mobile Applications. It details the authorization code grant, implicit grant, resource owner password credentials grant, and client credentials grant, highlighting security mistakes developers and architects make. The library includes working examples using the MEAN stack, and provides checklists for architects, developers, and testers to identify and exploit these vulnerabilities. |