grep -rl "authentication-bypass" ./articles
Titan, Microsoft's internal analytics service, checked a login token's tenant, audience, application and user — and never checked that it was signed. A 16-year-old researcher set the algorithm to none, typed admin into the user field, and was one. Microsoft blocked the endpoint in four days and paid 5,000 dollars.
CVE-2026-76504 scores 9.8 and needs no credentials: encode a single character of the login path and the authentication rule stops matching, leaving the API open as the admin user. Cisco published the advisory on 30 September, said its PSIRT had already seen exploitation, and offered no workaround. CISA added it to the catalogue the same day.
Two flaws in miniOrange's SAML SSO plugin for WordPress chain into a full authentication bypass, and attacks are already underway. One lets an attacker sign assertions with a key everybody has. The other treats an OpenSSL verification error as a pass. Fixes exist for all seven editions; the vendor's advisory covered one.
Nine vulnerabilities across Crosswork and Secure Workload, five of them scoring a maximum 10.0, including two separate authentication bypasses and a SQL injection. None are known to be exploited. All came out of Cisco's own internal review, which is the second such batch in a fortnight.
CVE-2026-19490 lets a remote unauthenticated attacker walk past authentication on NetScaler appliances configured as a gateway or AAA virtual server. Nothing has been seen in the wild. Rapid7's advice is to patch on an emergency basis anyway, and NetScaler's history is the argument.