The newest Authentication resources are on the Authentication page. For a reading order instead of a date order, see the Authentication learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-17 2026 | OAuth Vulnerabilities Part II (Bug Bounty 2k25) intermediate | OAuth Vulnerabilities Part II (Bug Bounty 2k25) |
| 2026-04-17 2026 | Bug-Bounty-Methodology: 2FA testing intermediate 2 min read | Library detailing bug bounty methodologies for testing Two-Factor Authentication (2FA). It covers techniques such as response manipulation, OTP brute-forcing, testing token expiration, bypassing 2FA by directly accessing dashboards, and searching for 2FA codes in JS files. Additional methods include CSRF/clickjacking to disable 2FA, bypassing 2FA via OAuth, discovering vulnerabilities in disabling 2FA without it, resetting passwords without 2FA, and exploiting backup code facilities. The guide also explores permanent DoS on unregistered users and OTP bypasses within JSON payloads, including request manipulation for null responses or parameter changes. |
| 2026-04-17 2026 | Bug Bounty: Authentication Testing - Brute Force to Bypass intermediate | Bug Bounty: Authentication Testing - Brute Force to Bypass |
| 2026-04-17 2026 | HackerOne Report #209008: Authentication Bypass - Automattic news | HackerOne Report #209008: Authentication Bypass - Automattic → hackerone.com |
| 2026-04-17 2026 | Web Security Bug Bounty: Bypassing Authentication via Logical Flaw intermediate | Web Security Bug Bounty: Bypassing Authentication via Logical Flaw |
| 2026-04-16 2026 | Attacks via OAuth Authorization Code Injection intermediate AuthZ | Attacks via OAuth Authorization Code Injection |
| 2026-04-16 2026 | This OAuth Bug Earned Me $$$$: Account Takeover via Identity Injection intermediate | This OAuth Bug Earned Me $$$$: Account Takeover via Identity Injection |
| 2026-04-16 2026 | Session Management Vulnerabilities: What Developers Get Wrong beginner 7 min read | Reference detailing common session management vulnerabilities developers introduce, such as session fixation via URL-based tokens and session hijacking through network interception, XSS, or log exposure. It stresses the importance of cryptographically secure pseudorandom number generators for token entropy, unconditional token regeneration upon login, and browser-level cookie security attributes like `Secure`, `HttpOnly`, and `SameSite`. The reference also emphasizes the necessity of both idle and absolute session timeouts, adjusting durations based on risk levels, and recommends against extending primary session tokens for "remember me" functionality. → onsecurity.io |
| 2026-04-16 2026 | Bypassing the Protections: MFA Bypass Techniques intermediate 7 min read | Library detailing Multi-Factor Authentication bypass techniques, including HTTP response body manipulation, status code manipulation, forceful browsing, CSRF and clickjacking to disable MFA, cached OTPs in dynamic JavaScript, missing integrity checks on OTPs, lack of brute-force protection on OTP validation, OTP code reusability, and code leakage in responses. → cobalt.io |
| 2026-04-16 2026 | Session Hijacking in 2025: Techniques, Attack Examples and Defenses intermediate 13 min read | Library for understanding session hijacking, detailing techniques like session sniffing, cross-site scripting (XSS), session fixation, man-in-the-middle attacks, cookie theft via malware, and session ID prediction. It covers the impact of unauthorized session control, distinguishing between session fixation and hijacking, and explores defenses to secure user sessions against these prevalent web application threats. |
| 2026-04-16 2026 | The $12,000 2FA Bypass - So Simple, Yet So Critical intermediate | The $12,000 2FA Bypass - So Simple, Yet So Critical |
| 2026-04-16 2026 | Race Condition Authentication Bypass: Full Account Takeover intermediate | Race Condition Authentication Bypass: Full Account Takeover |
| 2026-04-16 2026 | Token-Based Attacks: How Attackers Bypass MFA intermediate 9 min read | Library for detecting and preventing token theft attacks, which bypass MFA by stealing authentication tokens like OAuth tokens and session cookies. The library details methods such as AiTM (Adversary-in-the-Middle) phishing, OAuth 2.0 Device Authorization Grant exploitation, ConsentFix, malware-based extraction from browsers, and supply chain breaches. It highlights how stolen tokens grant persistent access to SaaS applications and cloud resources, often with broader permissions than intended, and remain undetected by traditional security controls as they represent valid authentication. |
| 2026-04-11 2026 | WebAuthn Guide beginner 12 min read | Guide to Web Authentication API (WebAuthn), a W3C and FIDO specification, detailing its use of public key cryptography for passwordless authentication. It explains how WebAuthn integrates with authenticators like Windows Hello and Touch ID, creating scoped and attested public-private keypairs to enhance security against phishing and data breaches. The guide covers key concepts like challenges, relying parties, user identification, and public key parameters, alongside code examples for credential creation using `navigator.credentials.create()`. |
| 2026-04-11 2026 | OWASP Credential Stuffing Prevention Cheat Sheet beginner 11 min read | Library from OWASP offering a comprehensive cheatsheet for defending against credential stuffing and password spraying attacks. It emphasizes Multi-Factor Authentication (MFA) as the primary defense, detailing tiered implementations and risk-based MFA triggers. For scenarios where MFA isn't feasible, it outlines alternative layered defenses including secondary passwords, CAPTCHAs, and advanced IP mitigation strategies that consider IP classification and geographic origin. The cheatsheet also touches upon device fingerprinting and the importance of defense-in-depth with robust metric collection. → cheatsheetseries.owasp.org |
| 2026-04-11 2026 | OAuth/OIDC Real-Life Attack Scenarios intermediate 7 min read | Writeup detailing real-life attack scenarios against OAuth and OpenID Connect configurations, focusing on JWT vulnerabilities. It covers account takeover by cracking JWT secret keys with tools like John The Ripper or Hashcat and exploiting the 'none' algorithm vulnerability by manipulating unsigned tokens. The writeup also mentions exploit chaining, where finding an exposed `.env` file containing a JWT secret facilitated an attack. |
| 2026-04-11 2026 | OAuth 2.0 Redirect URI Validation Falls Short (ACM) advanced | OAuth 2.0 Redirect URI Validation Falls Short (ACM) → dl.acm.org |
| 2026-04-11 2026 | PortSwigger: Hidden OAuth attack vectors intermediate 12 min read | Research identifies three new OAuth2 and OpenID Connect vulnerabilities: "Dynamic Client Registration: SSRF by design," "redirect_uri Session Poisoning," and "WebFinger User Enumeration." The research details how parameters like `jwks_uri` and `request_uris` in dynamic client registration, and `logo_uri` in MITREid Connect, can be exploited for SSRF. It also touches upon the potential for XSS through the `logo_uri` parameter. → portswigger.net |
| 2026-04-11 2026 | Cloudflare FIDO2 + Zero Trust intermediate 7 min read | Library detailing Cloudflare's migration from a "castle and moat" VPN architecture to a Zero Trust model, replacing TOTP with FIDO2/WebAuthn hardware security keys like YubiKeys. The library explains how FIDO2's phishing-resistant, challenge-response mechanism, which cryptographically binds authentication to specific domains, underpins this transition. It highlights the use of Cloudflare Access for selective enforcement and role-based access control, ultimately leading to the complete phasing out of TOTP and SMS-based MFA in favor of a unified, phishing-proof authentication standard. → blog.cloudflare.com |
| 2026-04-11 2026 | IOActive: Authentication Downgrade / MFA Bypass intermediate 12 min read | Tool utilizing Cloudflare Workers to perform authentication downgrade attacks against FIDO2/WebAuthn, weaponizing serverless infrastructure as a transparent proxy to manipulate authentication flows. This technique forces victims to fall back to phishable methods like push notifications or OTPs by injecting malicious payloads that alter JSON configuration objects and potentially hide FIDO2 options, a method also observed in attacks by 0ktapus and Scattered Spider. |
| 2026-04-11 2026 | Proofpoint: FIDO Authentication Downgrade intermediate 6 min read | Technique for performing FIDO authentication downgrade attacks, leveraging user agent spoofing with Evilginx to force Microsoft Entra ID users to less secure authentication methods and enable adversary-in-the-middle (AiTM) credential and session cookie theft. |
| 2026-04-11 2026 | How Attackers Bypass Synced Passkeys intermediate 6 min read | Library detailing how attackers bypass synced passkeys through cloud account compromise, phishing proxies, and malicious browser extensions like those exploiting the `webAuthenticationProxy` API or DOM-based clickjacking. It highlights risks with iCloud and Google Cloud syncing, authentication downgrade attacks against Microsoft Entra ID, and the need for device-bound passkeys, recommending enterprise policies to enforce phishing-resistant, device-bound authenticators and block fallback methods. → thehackernews.com |
| 2026-04-11 2026 | Okta Auth0 nextjs-auth0 OAuth Parameter Injection news 4 min read | Library providing OAuth parameter injection protection; discovered in Okta’s auth0/nextjs-auth0 by Joshua Rogers, this vulnerability allows attackers to manipulate authentication flows by injecting malicious parameters, potentially leading to unauthorized access and token leaks. The flaw, attributed to AI-generated code lacking sufficient sanitization, impacts Next.js applications using the library, mirroring similar CVE-2025-29927. |
| 2026-04-11 2026 | CVE-2025-47275: Auth0-PHP SDK Critical news | Library for detecting authentication bypass vulnerabilities within the Auth0-PHP SDK, specifically addressing CVE-2025-47275. This critical flaw allows attackers to circumvent authentication mechanisms. → wiz.io |
| 2026-04-11 2026 | Remitly: 0-Click Account Takeover (HackerOne) intermediate | Remitly: 0-Click Account Takeover (HackerOne) → hackerone.com |
| 2026-04-11 2026 | Post SMTP Plugin Account Takeover (400K+) intermediate 3 min read | Writeup on CVE-2025-24000, a Subscriber+ account takeover in Post SMTP plugin versions 3.2.0 and below. The vulnerability arises from broken access control in REST API endpoints, allowing any logged-in user, even Subscribers, to view sensitive email logs and credentials. This enables attackers to intercept password resets and achieve full site takeover. The issue is resolved in version 3.3.0 with an added privilege check for the `get_logs_permission` function. |
| 2026-04-11 2026 | CVE-2025-34291: Langflow ATO + RCE news 7 min read RCE | Library detailing CVE-2025-34291, a critical account takeover and RCE vulnerability in Langflow. This flaw, exploitable via a malicious webpage, chains together permissive CORS settings and a misconfigured `refresh_token_lf` cookie with `SameSite=None` to achieve a full session hijack. Attackers can then leverage a valid access token to trigger the previously disclosed unauthenticated RCE vulnerability in the `/api/v1/validate/code` endpoint, leading to compromise of sensitive tokens and API keys. |
| 2026-04-11 2026 | Grafana CVE-2025-6023: Full Account Takeover news 9 min read | Writeup detailing CVE-2025-6023 and CVE-2025-6197, critical vulnerabilities in Grafana. Discovered by a fellow in the OPSWAT Critical Infrastructure Cybersecurity Graduate Fellowship Program, these flaws chain an open redirect with client-side path traversal, leading to Cross-Site Scripting (XSS) and full account takeover. The writeup highlights an incomplete patch for a previous vulnerability, CVE-2025-4123, which left an alternative open redirect endpoint exploitable. |
| 2026-04-11 2026 | Fortinet FortiGate SAML SSO Bypass Active Attack intermediate 2 min read | Analysis of Fortinet FortiGate SAML SSO bypass, actively exploited via CVE-2025-59718 and CVE-2025-59719, which allow unauthenticated bypass of SSO logins using crafted SAML messages when FortiCloud SSO is enabled. Threat actors are using hosting providers like The Constant Company llc and Bl Networks to perform malicious logins and export device configurations. CISA has added CVE-2025-59718 to its Known Exploited Vulnerabilities catalog. → thehackernews.com |
| 2026-04-11 2026 | CVE-2025-59718: FortiCloud SSO Authentication Bypass news 2 min read | Writeup of CVE-2025-59718, a critical authentication bypass in FortiCloud SSO. This Improper Verification of Cryptographic Signature (CWE-347) vulnerability allows unauthenticated remote attackers to achieve administrative access by submitting a crafted SAML packet to the `/remote/saml/login` endpoint. The flaw impacts multiple Fortinet products including FortiOS and FortiProxy. → picussecurity.com |
| 2026-04-11 2026 | CVE-2025-47949: samlify SAML SSO bypass news 4 min read | Library that implements SAML 2.0 Single Sign-On, samlify, versions prior to 2.10.0 are vulnerable to CVE-2025-47949, a critical Signature Wrapping attack. This allows attackers to forge SAML Responses by introducing a malicious assertion into a legitimately signed XML document, leading to authentication bypass and user impersonation. Exploitation is easy, requiring only a valid signed XML from the Identity Provider. Upgrading to samlify version 2.10.0 or later is the recommended fix. → endorlabs.com |
| 2026-04-11 2026 | Sign in as anyone: Bypassing SAML SSO authentication with parser differentials intermediate 12 min read | Library for bypassing SAML SSO authentication by exploiting parser differentials in ruby-saml (versions up to 1.17.0), leading to CVE-2025-25291 and CVE-2025-25292. Attackers can craft SAML assertions using a valid signature to achieve account takeover. Researchers discovered that ruby-saml uses both REXML and Nokogiri XML parsers, and exploiting differences in how they process XML allowed for signature verification bypass, as demonstrated against GitLab. → github.blog |
| 2026-04-11 2026 | GitHub Enterprise SAML Authentication Bypass (CVE-2024-4985 / CVE-2024-9487) news 9 min read | Library analyzing GitHub Enterprise's SAML implementation, detailing CVE-2024-4985 and CVE-2024-9487 which allow bypassing authentication with encrypted assertions through improper signature verification. The research locally recreates the SAML handling, identifies issues in the `build` method's signature extraction logic, and examines how the `valid?` function processes signatures to bypass validation by exploiting the order of operations during decryption and signature checking. → projectdiscovery.io |
| 2026-04-10 2026 | Semrush OAuth redirect_uri bypass via IDN homograph — HackerOne #861940 intermediate | Semrush OAuth redirect_uri bypass via IDN homograph — HackerOne #861940 → hackerone.com |
| 2026-04-10 2026 | Slack OAuth2 redirect_uri bypass — HackerOne #2575 intermediate | Slack OAuth2 redirect_uri bypass — HackerOne #2575 → hackerone.com |
| 2026-04-10 2026 | Cisco Talos: State-of-the-art phishing — MFA bypass intermediate 9 min read | Library for detecting and defending against state-of-the-art phishing attacks that bypass multi-factor authentication (MFA) using adversary-in-the-middle (AiTM) techniques. It covers how Phishing-as-a-Service (PhaaS) kits like Tycoon 2FA and Evilproxy facilitate these attacks by intercepting credentials and authentication cookies via reverse proxies. The library also highlights WebAuthn as a strong defense against MFA bypass. → blog.talosintelligence.com |
| 2026-04-10 2026 | Bugcrowd: How attackers bypass multi-factor authentication (Part 1) intermediate | Bugcrowd: How attackers bypass multi-factor authentication (Part 1) → bugcrowd.com |
| 2026-04-10 2026 | webauthn.me: WebAuthn and Passkeys guide beginner 2 min read | Guide to WebAuthn and passkeys detailing their relationship, technical implementation, and use cases. Passkeys, a phishing-resistant passwordless authentication method, leverage the WebAuthn specification to enable secure user logins. The guide breaks down device-bound and synced passkeys, explaining their respective security implications and user experience benefits, and highlights how WebAuthn, alongside CTAP2, facilitates cross-device authentication. |
| 2026-04-10 2026 | FIDO Alliance: Passkeys overview beginner 12 min read | Library detailing Passkeys, a FIDO authentication credential leveraging public key cryptography to replace passwords with phishing-resistant cryptographic key pairs. Passkeys enable faster, simpler, and more secure sign-ins across devices, reducing credential stuffing, phishing attacks, and login abandonment. Resources include guides, use cases, design guidelines, and user communication materials for implementation. |
| 2026-04-10 2026 | Hackmanit: XML Signature Validation Bypass in SimpleSAMLphp and xmlseclibs intermediate 1 min read | Writeup details an XML signature validation bypass vulnerability impacting SimpleSAMLphp and xmlseclibs. This security flaw allows attackers to forge XML signatures, potentially leading to authentication bypass and unauthorized access to sensitive information within affected systems. |
| 2026-04-10 2026 | epi052: How to Hunt Bugs in SAML — A Methodology (Part II) intermediate | epi052: How to Hunt Bugs in SAML — A Methodology (Part II) |
| 2026-04-10 2026 | IBM: What is XML Signature Wrapping? beginner 9 min read | Library detailing XML Signature Wrapping (XSW) attacks, a vulnerability class impacting applications using XML-based security protocols like SAML, SOAP, and WS-Security. These attacks exploit XML's structural flexibility to trick systems into processing unauthenticated data while maintaining signature validity. The library covers attack methods such as element wrapping, ID attribute manipulation, namespace abuse, and XPath injection, highlighting their potential consequences like unauthorized access and privilege escalation through scenarios involving SAML SSO and SOAP web services. → ibm.com |
| 2026-04-10 2026 | USENIX: On Breaking SAML — Be Whoever You Want to Be advanced | USENIX: On Breaking SAML — Be Whoever You Want to Be |
| 2026-04-10 2026 | Astrix Security: How attackers exploit OAuth — a deep dive (Part 2) intermediate 8 min read | Library detailing how attackers exploit OAuth, focusing on non-human identities. It explains the OAuth flow, consent fatigue, and the over-granting of scopes and privileges. The library highlights how these vulnerabilities, coupled with inadequate protection of API keys, OAuth tokens, and service accounts, create a significant attack surface, allowing threat actors to bypass traditional security measures like MFA and gain unauthorized access to sensitive data. |
| 2026-04-10 2026 | The Hacker Recipes: OAuth 2.0 beginner 2 min read | Reference on OAuth 2.0 security, detailing common misconfigurations like insufficient redirect URI validation and credential leakage via referer headers or browser history. It explains attack vectors such as Authorization Code Injection and CSRF when the `state` parameter is absent, and highlights countermeasures including PKCE and `nonce` usage. |
| 2026-04-10 2026 | 0xn3va: OAuth 2.0 Vulnerabilities cheat sheet intermediate | 0xn3va: OAuth 2.0 Vulnerabilities cheat sheet → 0xn3va.gitbook.io |
| 2026-04-10 2026 | Cobalt: OAuth Vulnerabilities Part 2 intermediate 8 min read | Writeup detailing common OAuth vulnerabilities, including CSRF attacks mitigated by state parameters, authorization code theft via malicious websites and insecure redirect URIs, and authentication bypass in implicit flows by manipulating POST requests. It also covers SSRF via OpenID dynamic client registration, highlighting insecure use of client data and bypass techniques for redirect URIs. → cobalt.io |
| 2026-04-10 2026 | Vaadata: Understanding OAuth 2.0 and its common vulnerabilities beginner 10 min read | Library detailing OAuth 2.0, its function as an authorization protocol for resource access and delegated authentication, and common implementation vulnerabilities. It explains the roles of users, client applications, and authorization servers, and introduces OpenID Connect as an extension for standardized authentication using signed JSON Web Tokens (JWS) and claims. The resource highlights that while OAuth 2.0 and OIDC offer significant advantages, improper implementation can lead to security risks, emphasizing that vulnerabilities stem from how the protocols are applied rather than the protocols themselves. → vaadata.com |
| 2026-04-10 2026 | Doyensec: Common OAuth Vulnerabilities beginner 13 min read API Sec | Checklist for identifying common OAuth vulnerabilities, detailing attacks against the Implicit Flow, Authorization Code Flow, Authorization Code Flow with PKCE, Client Credentials Flow, Device Authorization Flow, and Resource Owner Password Credentials Flow. This resource helps testers and developers assess implementation security by explaining protocol complexities and known attack vectors. → blog.doyensec.com |
| 2026-04-10 2026 | OWASP WSTG: Testing for Session Fixation intermediate 4 min read | Reference detailing OWASP WSTG procedures for testing session fixation vulnerabilities. This guide outlines how to identify and exploit scenarios where session cookies are preserved across authentication, allowing attackers to impersonate users by forcing session IDs. It covers techniques for network attackers, the impact of session cookie integrity, and remediation strategies such as refreshing session tokens upon login. The document recommends using full HSTS adoption or __Host-/ __Secure- prefixes to prevent such attacks. → owasp.org |