AuthN learning path

Orientation and first principles — what the bug class is and how it behaves.

1. SAML Security (OWASP Cheat Sheet)
   18 min readcheatsheetseries.owasp.org2026
   Cheatsheet detailing Security Assertion Markup Language (SAML) security, focusing on the Web Browser SSO Profile with Redirect/POST bindings. It addresses message confidentiality and integrity via TLS 1.2, digital signatures, and XML encryption to counter eavesdropping, theft, and modification. The guide emphasizes validating protocol usage, referencing the Google SSO vulnerability, and securing signatures against XML Signature Wrapping attacks. It also covers binding implementations, security countermeasures like IP filtering and short lifetimes, and considerations for unsolicited responses and IdP-initiated SSO, identifying attacks such as Man-in-the-middle, Stolen Assertion, and Replay.
2. Vulnerable-OAuth-2.0-Applications (GitHub)
   6 min readgithub.com2026
   Library demonstrating common security pitfalls in OAuth 2.0 implementations for Classic Web Applications, Single Page Applications, and Mobile Applications. It details the authorization code grant, implicit grant, resource owner password credentials grant, and client credentials grant, highlighting security mistakes developers and architects make. The library includes working examples using the MEAN stack, and provides checklists for architects, developers, and testers to identify and exploit these vulnerabilities.
3. Vaadata: Understanding OAuth 2.0 and its common vulnerabilities
   10 min readvaadata.com2026
   Library detailing OAuth 2.0, its function as an authorization protocol for resource access and delegated authentication, and common implementation vulnerabilities. It explains the roles of users, client applications, and authorization servers, and introduces OpenID Connect as an extension for standardized authentication using signed JSON Web Tokens (JWS) and claims. The resource highlights that while OAuth 2.0 and OIDC offer significant advantages, improper implementation can lead to security risks, emphasizing that vulnerabilities stem from how the protocols are applied rather than the protocols themselves.
4. Doyensec: Common OAuth Vulnerabilities
   13 min readblog.doyensec.com2026
   Checklist for identifying common OAuth vulnerabilities, detailing attacks against the Implicit Flow, Authorization Code Flow, Authorization Code Flow with PKCE, Client Credentials Flow, Device Authorization Flow, and Resource Owner Password Credentials Flow. This resource helps testers and developers assess implementation security by explaining protocol complexities and known attack vectors.
5. OWASP Session Management Cheat Sheet
   33 min readcheatsheetseries.owasp.org2026
   Reference for OWASP Session Management covering secure generation of session IDs with sufficient entropy (at least 64 bits) and appropriate length to prevent brute-force guessing attacks. It also details avoiding predictable session ID content that could lead to information disclosure and recommends generic session ID names to prevent fingerprinting of web application technologies like PHP, J2EE, and ASP.NET.

Real testing methodology, tooling, and writeups that show the work.

1. How I Found a Critical OAuth Misconfiguration That Led to Account Takeover
   7 min readinfosecwriteups.com2026
   Library for analyzing critical OAuth misconfigurations; it details findings including open client registration, authorization requests processed without authentication, PKCE weaknesses, wildcard CORS, and Google SSO auto-provisioning, demonstrating how these individual issues can chain together to achieve account takeover through token theft.
2. No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452
   14 min readbishopfox.com2026
   Tool for verifying Citrix NetScaler SAML patch for CVE-2026-8452. This memory corruption bug, a heap overflow, allows attackers to trigger remote code execution via crafted SAML messages without authentication. The tool provides a safe method to externally check for the patch across Gateway and AAA virtual servers, analyzing SAML requests and responses without causing disruption. It also aids in hunting for indicators of compromise within logs, addressing related vulnerabilities like CVE-2026-8451 and CVE-2026-19490.
3. Hacking SAML with Claude Code
   6 min readoblique.security2026
   Tool that leverages an AI model, Claude Opus, to discover vulnerabilities in SAML implementations. The tool employs a multi-agent framework with storage for intermediate results and prioritizes work to exhaustively probe libraries. It identifies various bugs including authentication bypasses in Authentik, PHP litesaml/lightsaml, OneUptime, and Java's saml-client, alongside information disclosure and denial-of-service vectors affecting Python and Node.js ecosystems. The research demonstrates using AI with generalized threat models for vulnerability discovery.
4. The Danger of Multi-SSO AWS Cognito User Pools
   8 min readblog.doyensec.com2026
   Tool for analyzing AWS Cognito multi-SSO configurations, demonstrating vulnerabilities such as JIT ghost identity injection, trigger source value misinterpretations, and sub-splitting attacks. It highlights risks associated with malicious OIDC providers and insecure handling of IdP identifiers, leveraging Infrastructure as Code labs for experimentation.
5. Device Code Phishing: How Attackers Abuse Microsoft’s Legitimate Authentication Page Without…
   6 min readinfosecwriteups.com2026
   Writeup detailing Device Code Phishing, a technique leveraging Microsoft's legitimate authentication workflow to bypass traditional security measures. Attackers exploit the Device Code Flow, tricking users into authorizing attacker-controlled applications on official Microsoft domains, thereby obtaining valid access tokens without ever stealing passwords. This method circumvents typical phishing indicators like fake login pages and browser warnings, enabling unauthorized access to Microsoft 365 resources.

Novel research, edge cases, and the techniques that push the class forward.

1. SSO Protocol Security: Critical Vulnerabilities in SAML, OAuth, OIDC, JWT (2025)
   24 min readguptadeepak.com2026
   Library cataloging SAML, OAuth, OIDC, and JWT vulnerabilities, including XML Signature Wrapping attacks affecting Ruby SAML (CVE-2024-45409) and GitHub Enterprise Server (CVE-2024-6800), XML canonicalization bugs in various libraries (CVE-2017-11427 to CVE-2017-11430, CVE-2018-0489), assertion replay issues (CVE-2018-14637), and vendor-specific flaws like Oracle Access Manager (CVE-2021-35587). The analysis highlights recurring authentication bypasses and token forgery risks, emphasizing the impact and exploitability of these critical SSO protocol weaknesses.
2. The Fragile Lock: Novel Bypasses for SAML Authentication | PortSwigger Research
   13 min readportswigger.net2026
   Tool for bypassing SAML authentication, this library exploits parser-level inconsistencies in the Ruby and PHP SAML ecosystems. Novel techniques, including attribute pollution, namespace confusion, and Void Canonicalization attacks, enable attackers to bypass XML Signature validation while presenting valid SAML documents to applications. The toolkit aids in identifying discrepancies between XML parsers, facilitating the discovery of authentication bypasses with minimal requirements.
3. Hunting Account Takeovers in the Wild West of MCP OAuth Servers"
   6 min readblog.sicks3c.io2026
   Library for discovering and exploiting misconfigured OAuth implementations in MCP (Model Context Protocol) servers, commonly used to connect AI assistants like ChatGPT and Claude to third-party services. The library identifies vulnerabilities arising from open Dynamic Client Registration (DCR), missing redirect URI validation, and optional PKCE enforcement, which collectively enable one-click account takeover attacks where attackers can register malicious clients, craft deceptive authorization URLs, and intercept tokens without robust authentication.
4. Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking
   12 min readinfosecwriteups.com2026
   Library for understanding universal Google account takeovers via a confused deputy vulnerability. This exploit chains two bugs: a transferable device-code sign-in session and server-side lack of binding between `client_id` and `scope` to the `device_code`. By manipulating a URL with `prompt=none` and any link opened by a victim who has previously used "Sign in with Google," an attacker can silently obtain an access token for an arbitrary Google-registered client, bypassing consent screens and 2FA. This vulnerability, initially reported to Google's VRP and rewarded $13,337, leveraged the RFC 8628 device authorization grant.
5. Chaining a DOM XSS Sink, WAF Bypass, Cross-Origin Smuggling, and SDK Abuse into One Click Account…
   8 min readinfosecwriteups.com2026
   Library for exploiting a DOM XSS sink, bypassing Akamai's WAF via window.name, and abusing an authentication SDK to achieve one-click account takeover. The technique involves setting a malicious JavaScript payload in `window.name`, navigating to a vulnerable error page that uses `backURL` as a `javascript:` URI, and exploiting the SDK's functions to retrieve JWTs and temporary AWS STS credentials.
6. Beyond credentials: weaponizing OAuth applications for persistent cloud access | Proofpoint US
   7 min readproofpoint.com2025
   Tool for automating the creation of malicious internal OAuth applications, enabling persistent cloud access even after credential resets or MFA enforcement. Proofpoint researchers developed this tool to demonstrate how threat actors can hijack user accounts by registering second-party applications, configuring custom scopes, and authorizing them to access critical resources, thus bypassing traditional security measures and evading detection.
7. Spoofing Microsoft 365 Like Its 1995
   6 min readblackhillsinfosec.com2023
   Technique for spoofing Microsoft 365 emails by leveraging Microsoft Direct Send and Exchange Online Protection (EOP) settings. This method allows sending emails from internal or external addresses to other internal recipients within an organization by utilizing the mail.protection.outlook.com smart host and port 25, effectively bypassing many third-party mail gateways and landing emails directly in the inbox. The technique can be executed via PowerShell commands and easily rotated IP addresses, such as through Azure Cloud Shell.
8. OAuth 2.0 Redirect URI Validation Falls Short (ACM)
   dl.acm.org2026
   OAuth 2.0 Redirect URI Validation Falls Short (ACM)