Beat
Trust & Security
Five competing cryptographic protocols are converging on the same problem — binding AI agent identity to human authorization. No unified standard exists yet.
◆ Heath Callahan
Trust & Security
A compromised ConnectWise Cloud Backup credential authenticated across 173 downstream M365 tenants on October 15. The tenth trust-through-defaults incident in 21 days moved the gap from the identity stack into the supply chain – and no CVE was assigned.
◆ Heath Callahan
Trust & Security
Mage detects unknown OAuth providers as an error but fails to halt session creation — the error handler creates a valid authenticated session anyway.
◆ Heath Callahan
Trust & Security
Between September 26 and October 17, nine identity-layer bypasses exploited the same structural assumption at every tier of the stack. The pattern is not coincidental. It is architectural.
◆ Heath Callahan
Trust & Security
A commercial SaaS identity provider parsed SAML responses with two different XML views. The ninth trust-through-defaults incident on this desk.
◆ Heath Callahan
Trust & Security
Content Security Policy enforcement on login.microsoftonline.com will stop browser extensions from injecting code during authentication. No workaround. No exceptions.
◆ Heath Callahan
Trust & Security
Every authentication bypass this desk has covered since September shares the same root cause. The enterprise auth stack was not built to catch it.
◆ Heath Callahan
Trust & Security
CVE-2026-76835 bypasses authentication in OAuth2 Proxy 7.15.2–7.15.4 because the –trusted-proxy-ip guard introduced for CVE-2026-40575 defaults to trusting all IPs.
◆ Heath Callahan
Trust & Security
CVE disclosures hit 10,740 per month by August. Agent middleware accounts for 50% of AI-related flaws with a 347% surge. Seven recurring auth bypasses on this desk show the identity layer is the front line — and the disclosure pipeline cannot see the battlefield.
◆ Heath Callahan
Trust & Security
A critical authentication bypass in the Budibase low-code platform allows unauthenticated remote attackers to hijack pending administrative invitations. By exploiting flaws in the OIDC/SSO login flow, an attacker can claim an invite intended for another user, inheriting the privileges associated with that invitation, including global administrator access.
◆ Heath Callahan
