Search Results for “MAS” – Page 16

Mage OSS Ships an OAuth Bypass That Creates Sessions from Unrecognized Providers — the Tenth Trust-Through-Defaults Incident in Twenty-One Days

Mage OSS, a data pipeline orchestration tool, contains a critical authentication bypass vulnerability tracked as CVE-2026-111823. The flaw, identified in GHSA-93gm-r5p2-wxq7, carries a CVSS score of 9.8. It affects all versions of the platform through 0.9.80. The vulnerability stems from a failure in the OAuth callback handler, which incorrectly manages error states during the authentication…
Nine Identity-Layer Bypasses in Twenty-One Days: The Trust-Through-Defaults Pattern Has Reached Every Layer of the Stack

Between September 26 and October 17, 2026, nine distinct identity-layer bypasses appeared across every tier of the authentication stack. Each exploited the same structural assumption: that an assertion from a trusted source means what the receiving system assumes it means. The incidents span framework, library, plugin, appliance, identity provider, low-code, utility, browser-side, and implementation-layer SaaS…
Subscription Creep: When Agent Subscriptions Eat the Stack

The dream of a free, helpful AI sidekick living in your home has officially hit a wall. We are watching the home AI agent market pivot from a playground of experimentation into a landscape defined by recurring billing. Following our previous look at the landscape, the picture has become remarkably consistent: if you want a…
WorkOS Four SAML SSO Bypasses Trace to a Dual-View XML Parsing Gap

Between September 24 and 27, 2026, security researcher Alex Tan reported four SAML SSO authentication bypasses to WorkOS. The root cause was a dual-view XML parsing gap. WorkOS parsed SAML responses multiple times using different XML parsers, then converted the parsed response back to text before passing it to the signature verifier. This allowed a…
The OAuth/SAML Authentication Bypass Wave: Seven Months, Eight Vendors, One Structural Failure

Eight authentication bypasses in three weeks. Between September 26 and October 17, 2026, the enterprise landscape suffered a cascade of failures that, while reported as isolated incidents, reveal a singular, systemic rot: federation and proxy layers operating on a ‘trust-by-default’ basis, blindly accepting client-supplied assertions without binding them to the local security context. The Keycloak…
Budibase OIDC/SSO Auth Bypass Lets Attacker Claim Admin Invite — CVE-2026-100684

A critical authentication bypass in the Budibase low-code platform allows unauthenticated remote attackers to hijack pending administrative invitations. By exploiting flaws in the OIDC/SSO login flow, an attacker can claim an invite intended for another user, inheriting the privileges associated with that invitation, including global administrator access. The vulnerability, tracked as CVE-2026-100684, carries a CVSS…
Proofpoint Pays $6.3B for Varonis — The Largest Acquisition Explicitly Targeting AI Agent Data Security

A $6.3 billion all-cash price tag, representing a 52% premium over pre-rumor stock levels, tells a specific story about how the market values agent governance. When Proofpoint announced its acquisition of Varonis on October 15, 2026, the premium signaled that data security is no longer just a defensive perimeter play; it is being priced as…
Payward Acquires Saldo Bank: Europe’s Perimeter for Sale

Payward’s Saldo Bank acquisition makes it the first crypto-native firm to own a regulated European bank. In Europe the regulatory perimeter is for sale; in America it is still a queue.
Eight Days Out: AGNTCon Keynote Assignments Map the Agent Control-Plane Playbook

The AGNTCon+MCPCon North America 2026 keynote schedule and the program’s Featured Keynote Speakers page function as a strategic map of the emerging agent infrastructure landscape. By analyzing the speaker assignments, we can identify how major vendors are positioning their platforms and where they are concentrating their influence. The stage in San Jose this October reveals…
SolarWinds Ships a Standalone AI Agent to 300,000 Enterprise Customers. It Brings Zero Outcome Data.

SolarWinds launched Avior on October 14, a standalone agentic AI system for mission-critical IT environments. That makes it the fifth IT monitoring or operations vendor to ship a governed agent product in roughly 48 hours, after LogicMonitor, Druid AI, NeuBird ARC, and SolarWinds’ own announcement. But what sets this one apart is the installed base:…