111 results for “OAuth”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types111 Articles32 Write-ups23 Threads18 Advisories15 Repos15

More types3

Tools4 Papers3 Other1

“OAuth”

x.comthread🛡️ Security

川崎元 (@foryangxin) on X

CVE-2025-6514 is an OS command injection (CWE-78, CVSS 9.6) in mcp-remote 0.0.5 to 0.1.15, fixed in 0.1.16. A malicious MCP server supplies a crafted authorization_endpoint during OAuth discovery, and the open package passes it to PowerShell on Windows. The thread cites the MCP spec's URL scheme allowlist rules and advises treating discovery metadata as untrusted, pinning bridge tools and sandboxing them.

Model Context Protocolmcp-remoteOAuth+3

CVE-2025-6514CWE-78SSRF+2

AI Security, Identity & Access, AppSec· Added 2 Nov 2026, published 30 Oct 2026

oversecured.comarticle🛡️ Security

Inside mobile taint analysis: how source-to-sink tracking finds real data-leak paths | Oversecured Blog

Oversecured explains taint analysis for Android and iOS apps and contrasts it with pattern-matching SAST such as MobSF. It covers source, flow and sink, cross-component tracking over Intents, flag-based sanitizer modeling and implicit intent simulation. The case study is an unsafe Class.forName().newInstance() on a Serializable transportFactoryClassName field in Google's com.google.auth.oauth2 credential classes, which Google fixed with a $3,133.70 bounty.

AndroidiOSOversecured+3

intent redirectionpath traversalSSRF+4

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

Vulnerabilities that lead to account takeover in banking and fintech mobile apps | Oversecured Blog

Oversecured guide to eight vulnerability categories that lead to account takeover in mobile banking and fintech apps: WebView JavaScript bridge token leakage, Intent Redirection, hardcoded tokens, deeplink hijacking, insecure token storage, localhost OAuth listeners, AIDL abuse and weak biometric auth. It includes a WebView PoC based on Samsung SmartThings CVE-2022-30746 and maps findings to OWASP MASVS, PCI DSS and PSD2. It argues taint analysis plus dynamic PoC is needed to find multi-component chains.

AndroidiOSOAuth+1

CVE-2022-30746Intent Redirectiondeeplink hijacking+9

Mobile Security, AppSec, Identity & Access· Added 29 Oct 2026

x.comtool🧠 AI

Big Bull (@BIGBULLapp) on X

clauth is a Rust terminal UI for Claude Code that combines multi-account switching with a live 5h / 7d usage monitor. A fallback chain moves the user off an exhausted account before Claude Code blocks. It supports Pro, Max, Team and Enterprise OAuth accounts and custom API endpoints on Linux, macOS and Windows. The post notes that auto-switching means the tool decides when accounts change.

Claude CodeRustOAuth+4

clauthAnthropic

coding-agents, ai-infra· Added 30 Oct 2026, published 28 Oct 2026

x.comthread🛡️ Security

Kizuno18 (@Kizuno18) on X

Thread by Kizuno18 on the move from local stdio/Docker Model Context Protocol servers to remote HTTP/SSE endpoints in enterprise infrastructure. It names three trade-offs: credential boundary inversion (short-lived OAuth/JWT tokens instead of long-lived admin tokens on workstations), tool schema bloat solved by deferred discovery, and governance via HCP Terraform policy-as-code (Sentinel/OPA), audit trails and approvals. It is opinion, with no data or implementation detail.

Model Context ProtocolTerraformDocker+2

Sentinelblast radiuspolicy-as-code+1

AI Security, Identity & Access, DevSecOps· Added 29 Oct 2026, published 27 Oct 2026

x.comthread🧠 AI

Kizuno18 (@Kizuno18) on X

Kizuno18's X post argues that the move from local stdio and Docker MCP servers to remote HTTP/SSE endpoints matures the Model Context Protocol in enterprise infrastructure. It lists three trade-offs: short-lived OAuth/JWT bearer tokens replace mounted admin credentials, deferred tool discovery avoids roughly 20k tokens of eager schema loading, and HCP Terraform enforces Sentinel/OPA policy, audit trails and approvals server-side. Opinion post with no benchmarks or code.

Model Context ProtocolDockerTerraform+5

Kizuno18HCP TerraformOPA

mcp· Added 29 Oct 2026, published 27 Oct 2026

x.comthread🛡️ Security

cubillas (@cubillas888) on X

The tweet relays Pillar Security research that opencode on Windows and WSL could run attacker-controlled code during remote MCP server OAuth sign-in. The fix shipped in opencode 1.18.33 on 28 September, with no advisory or CVE published. It advises users of remote MCP servers to update and review which servers they connect to. Technical details are not in the post.

OpenCodeModel Context ProtocolOAuth+1

Pillar Security

AI Security, AppSec· Added 29 Oct 2026, published 27 Oct 2026

x.comtool🛡️ Security

Brute (@BRuteLogic) on X

OBroken is Brute Logic's proprietary scanner for OAuth authorization bypasses. It covers 23 techniques across 17 vulnerability classes and produces a standalone Find/Forge/Fire PoC for each finding. The demo runs the missing audience validation case (CVE-2025-9803): it discovers the authorization server, gets a token bound to an attacker resource, and confirms the real API accepts it. A public OAuth bypass testbed accompanies it.

OAuth

CVE-2025-9803OBrokenjBroken+2

Identity & Access, Offensive Security, AppSec· Added 28 Oct 2026, published 26 Oct 2026

x.comthread🛡️ Security

David Gutierrez | Eng (@david_x_ai) on X

Thread on a critical opencode bug disclosed by Pillar Security on Oct 19. On Windows and WSL, a remote MCP server could run code during OAuth sign-in, because the server-chosen authorization URL was put unescaped into a PowerShell command, so a PowerShell subexpression executed. opencode fixed it in 1.18.33 on Sep 28 as a browser-launch refactor with no advisory or CVE. MCP Inspector published an advisory for the same bug class, and its fix needs a major bump of the open package.

OpenCodeModel Context ProtocolPowerShell+3

Pillar Securitycommand injectionPowerShell subexpression+1

AI Security, AppSec, Supply Chain· Added 27 Oct 2026, published 25 Oct 2026

x.comthread🛡️ Security

Prasenjit Sarkar (@stretchcloud) on X

Post on the LiteLLM supply-chain compromise. Attackers spent eleven days in the GitHub org, ran a workflow on a throwaway branch to take twenty secrets including a GitHub App private key, then used stolen GitHub CLI OAuth tokens to publish malicious release 1.107.0 from a lookalike Berri-AI repo. A Python startup file harvested sixteen credential categories and LiteLLM proxy Postgres provider keys. Socket flagged the wheels in seven minutes.

LiteLLMPyPIGitHub Actions+3

Berri-AIBerriAILiteLLM 1.107.0+3

Supply Chain, DevSecOps, AI Security· Added 26 Oct 2026, published 24 Oct 2026

securityweek.comarticle🛡️ Security

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

Storm-0940, a China-linked APT, used the open source AI penetration testing framework Artex to automate a mid-October 2026 campaign against ConnectWise customers, per Microsoft. Artex drove reconnaissance, password spraying and OAuth application abuse at more than 2,900 attempts per minute, with sign-in attempts against over 2,250 tenants. Attackers modified application credentials for persistence, and Microsoft advises correlating service principal sign-ins with Graph activity.

Microsoft Entra IDMicrosoft 365OAuth+3

Storm-0940ArtexConnectWise+4

Threat Intel, AI Security, Identity & Access· Published and added 23 Oct 2026

securityweek.comarticle🛡️ Security

LiteLLM Compromised in Fresh Supply Chain Attack

LiteLLM version 1.107.0 was published with malware to PyPI and Docker Hub on October 21, for about three hours and roughly 49,000 downloads. Attackers used GitHub CLI OAuth tokens, likely leaked through Claude Code into LiteLLM logs, to disable branch protections, redirect the releaser to a lookalike repository and sign poisoned artifacts. The payload is an infostealer and RAT; Wiz saw Amazon Bedrock abuse. The last clean version is 1.106.2.

LiteLLMPyPIDocker+3

Berri-AI/litellmLLMjackingdead drop+1

Supply Chain, DevSecOps, AI Security· Published and added 23 Oct 2026

x.comthread🛡️ Security

Dark Web Intelligence (@DailyDarkWeb) on X

LiteLLM suspects its October 21 release compromise began with Claude Code responses containing GitHub CLI OAuth tokens that were written to logs of an internet-facing internal LiteLLM gateway. Attackers allegedly stole those tokens, used an organization-owner token to disable branch protections, and pushed poisoned artifacts from a lookalike repository. How they entered the gateway is unconfirmed, and this is not a proven Claude Code vulnerability.

LiteLLMClaude CodeGitHub+1

LiteLLM release compromiselookalike repositorybranch protection bypass

Supply Chain, DevSecOps, AI Security· Added 25 Oct 2026, published 22 Oct 2026

unit42.paloaltonetworks.comarticle🛡️ Security

The Current Landscape of OAuth Attacks

Unit 42 survey of OAuth attacks that steal tokens after MFA, so access survives password resets. It covers account hijacking (device authorization and authorization code misuse), permission hijacking (vague or impersonating app names), and malicious redirects, including the error-triggered redirect campaign Microsoft documented in March 2026. It also describes COSF and OAuth-as-a-service flaws, PhaaS and LLM evasion trends, and defenses such as admin-only consent and redirect_uri audits.

OAuthMicrosoft Entra IDCloudflare Workers+2

Cross-User OAuth Session FixationCross-Tenant Client ID ConfusionCross-Connector OAuth Account Takeover+7

Identity & Access, Threat Intel, Blue Team & Detection· Added 30 Oct 2026, published 22 Oct 2026

x.comthread🛡️ Security

Muscle AI (@themuscleai) on X

Post on the LiteLLM 1.107.0 PyPI compromise published 21 October 2026 and quarantined about 1 hour 43 minutes later. A malicious .pth file ran at Python startup and stole cloud credentials, private keys, browser data and AI tool auth files, then POSTed a tarball to an attacker endpoint. The author says attackers used stolen GitHub CLI OAuth tokens to push a trojanized commit chain and build official wheels. It lists five defenses: hash-pinned lockfiles, per-tool capped keys, release cooling periods, secret isolation and egress monitoring.

LiteLLMPyPIPython+3

TeamPCPcook.pth

Supply Chain, DevSecOps, AI Security· Added 23 Oct 2026, published 22 Oct 2026

wiz.ioarticle🛡️ Security

ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors

Wiz Research reports an actor overlapping with Storm-0940 that used ARTEX, an open-source autonomous AI penetration-testing agent, against IT and software vendors in October 2026. It documents source-map and Swagger recon, OAuth callback and unsigned JWT probing, Cognito account-recovery abuse, tenant-isolation tests and Okta/Entra password spraying. The post lists log signals that mark the activity as agentic, such as one-second spray cadence and automatic IP and user-agent rotation.

OktaMicrosoft Entra IDAWS Cognito+3

ARTEXStorm-0940Wiz Research+5

Threat Intel, AI Security, Identity & Access· Published and added 22 Oct 2026

x.comrepo🧠 AI

Dan Kornas (@DanKornas) on X

aula-mcp is an open-source (MIT) TypeScript MCP server that connects an AI client to Denmark's Aula school platform. It exposes tools for profiles, calendar events, messages, notifications, posts and weekly plans. MitID credentials and OAuth tokens are stored in macOS Keychain or an AES-256-GCM encrypted file. The HTTP server binds to 127.0.0.1, and the presence write tool stays off until AULA_MCP_WRITE=1 is set.

Model Context ProtocolTypeScriptClaude Code+3

AulaMitIDDan Kornas

mcp· Added 23 Oct 2026, published 22 Oct 2026

x.comthread🛡️ Security

SecureChap (@SecureChap) on X

Post describing a LiteLLM 1.107.0 PyPI compromise in which attackers used stolen GitHub CLI OAuth tokens from three engineers to trigger and approve the project-releaser workflow, producing eight malicious wheels and a tampered tarball. The wheels drop cook.pth, which runs at Python startup, and privcollect steals cloud tokens, keys, browser data, AI configs and LiteLLM proxy credentials, exfiltrating to litellm[.]dev/healthcheck. A second daemon polls a GitHub domain.txt hourly for new domains to fetch and execute. PyPI yanked the package the same day. The post is a single unsourced tweet.

LiteLLMPyPIpip+3

cook.pthprivcollectlitellm[.]dev+2

Supply Chain, DevSecOps, Threat Intel· Published and added 22 Oct 2026

x.comthread🛡️ Security

VibecodersHQ (@VibeCodrHQ) on X

Post summarising Pillar Security's finding of a remote code execution flaw in OpenCode, the open-source AI coding agent. Versions 1.0.137 through 1.18.32 could run code from a remote MCP server during OAuth sign-in on Windows and WSL, with no prompt injection needed. The fix is in 1.18.33 (released 28 September). No advisory or CVE was issued, so scanners will not flag old installs. Interim advice is to remove unvetted remote MCP servers.

OpenCodeModel Context ProtocolOAuth+1

Pillar SecurityOpenCode Console breach

AI Security, AppSec· Added 22 Oct 2026, published 21 Oct 2026

microsoft.comwriteup🛡️ Security

AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise

Microsoft Threat Intelligence report on Storm-0940, a China-state aligned actor that used the open-source agentic AI pentest framework ARTEX from September 2026 to automate attacks on hundreds of organizations. It links the actor to the October 2026 ConnectWise multi-tenant OAuth app compromise (2,250+ tenants, 2,900 sign-ins per minute, privileged access in under 3 hours). It gives IOCs, Defender XDR and Sentinel KQL hunting queries, ATT&CK mapping and mitigations.

Microsoft 365Microsoft Entra IDMicrosoft Defender XDR+3

Storm-0940ARTEXConnectWise Cloud Backup+12

Threat Intel, AI Security, Identity & Access, Blue Team & Detection· Published and added 21 Oct 2026

securitylabs.datadoghq.comwriteup🛡️ Security

LiteLLM supply chain compromise: What you need to know

LiteLLM version 1.107.0 was published to PyPI and official Docker images on 21 October 2026 and stayed live for about two hours. Attackers used stolen GitHub CLI OAuth tokens from three engineers to run the release pipeline against a lookalike fork, Berri-AI/litellm. The payload (cook.pth, cook.py, sitecustomize.py) steals cloud, developer, AI-tool and browser credentials, and includes a polling RAT. The post lists removal and rotation steps.

LiteLLMPyPIPython+2

cook.pthTeamPCPBerri-AI/litellm+3

Supply Chain, DevSecOps, Threat Intel· Added 29 Oct 2026, published 21 Oct 2026

x.comthread🛡️ Security

DFIR Radar (@DFIR_Radar) on X

DFIR_Radar weekly detection engineering digest covering 23 new and 19 updated rules across 6 GitHub repositories. It lists KQL rules for Azure Key Vault secret retrieval, MCP client User-Agent bulk operations and local Azure token theft, AWS CloudTrail analytics, Sigma rules for firewall and ETW tampering (decimal 17 vs hex 0x11), updated LOLDrivers hashes, and Sublime email rules for OAuth consent phishing and fake IRS W-9 PDFs.

KQLSigmaMicrosoft Sentinel+3

BYOVDCisco AI Defensebenscha/KQLAdvancedHunting+7

Blue Team & Detection, Cloud & Infra, AI Security· Added 20 Oct 2026, published 19 Oct 2026

x.comthread🧠 AI

Angel (@ziran_pu) on X

AshAi, the AI package for the Elixir Ash Framework, is getting MCP client tools. Creating an MCP server with AshAi was already simple, but connecting your own LLM tool loop to an external MCP server had to be built by hand. The planned release includes OAuth client management resources. The post gives no release date, API details or code.

Model Context ProtocolAsh FrameworkAshAi+2

mcp· Added 21 Oct 2026, published 19 Oct 2026

x.comthread🛡️ Security

Santhosh Patel (@santhosh_patell) on X

Summary of Pillar Security research on opencode, in which a malicious remote MCP server runs code on a Windows or WSL machine during the OAuth login step. The login URL goes unsanitised into PowerShell through the npm "open" package, so an https:// link containing $(...) executes. Affected versions are 1.0.137 to 1.18.32, fixed in 1.18.33 (28 September) as a "refactor" with no advisory or CVE. The behaviour was first reported in 2020 as a WSL 2 broken-link bug.

OpenCodeModel Context ProtocolPowerShell+3

Pillar SecurityCWE-78silent fix

AI Security, AppSec, Supply Chain· Added 21 Oct 2026, published 19 Oct 2026

github.comrepo🧠 AI

Show HN: WhatsApp MCP running free on Cloudflare

whatsapp-mcp is an MCP server that runs in the user's own Cloudflare account and lets MCP clients such as Claude Code and Claude Desktop search and read WhatsApp chats. It links as a WhatsApp Web-style device through Baileys, stores messages in SQLite with FTS5 inside a Durable Object, and is read-only. The README documents deployment, OAuth sign-in, contact naming through agents, and workerd shims for Baileys.

Model Context ProtocolCloudflareCloudflare Workers+11

mcp· Added 20 Oct 2026, published 18 Oct 2026

x.comthread🧠 AI

Bikash | Hermes Super-Intel (@BkashJosi) on X

Post by Bikash (@BkashJosi) ranking open GitHub issues labelled type/feature for the Hermes agent framework by thumbs-up reactions. The query returned 5,349 issues and only one has more than 50 votes. The top three are Claude Agent SDK with subscription OAuth (57), remote Hermes with local tool execution (41) and Mistral provider support (32), followed by backups, configuration sync and context reduction. The full top 10 is only in the video.

HermesClaude Agent SDKOAuth+2

Nous Research

agents· Added 20 Oct 2026, published 17 Oct 2026

x.comadvisory🛡️ Security

Microsoft Threat Intelligence (@MsftSecIntel) on X

ConnectWise Cloud Backup (formerly SkyKick Backup, AppId 506e08f9-6e9a-4da4-942b-a099a03644ae) had its multitenant OAuth app compromised, per Microsoft Threat Intelligence. On 15 October 2026 the actor authenticated broadly as the service principal from 144.172.64[.]128, likely using customer-granted permissions such as Directory.ReadWrite.All, then ran Graph API reconnaissance and tried to add credentials to the service principal as a backdoor. The post lists IOCs, Defender alerts and hunting advice.

OAuthMicrosoft Entra IDMicrosoft Defender+1

ConnectWise Cloud BackupSkyKickDirectory.ReadWrite.All+2

Threat Intel, Identity & Access, Supply Chain, Blue Team & Detection· Added 20 Oct 2026, published 17 Oct 2026

huntress.comarticle🛡️ Security

Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.

Huntress post on where accounts remain exposed after a passkey rollout. It covers passkey-themed social engineering, the EvilTokens device-code phishing campaign (344 organizations in about 16 days), weak enrollment and recovery, SpecterOps research on Windows WebAuthn hooking on compromised endpoints, and the trade-offs between synced and device-bound passkeys. It closes with ITDR-style post-login monitoring, containment steps (revoke sessions, remove rogue authenticators, hunt inbox rules, OAuth grants, forwarding), and a five-question deployment checklist.

WebAuthnFIDO2Windows+2

EvilTokensdevice code phishingpasskey-themed phishing+4

Identity & Access, Blue Team & Detection, Threat Intel· Published and added 14 Oct 2026

securityweek.comarticle🛡️ Security

SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities

SecurityWeek summarizes SAP's October 2026 Security Patch Day (22 notes, four critical). Critical flaws: CVE-2026-89111 (CVSS 10) OAuth2 SSRF in SAP Cloud SDK for Python that leaks client credentials via the tenant_subdomain parameter; CVE-2026-89110 (9.9) NetWeaver broken access control allowing ABAP code execution through Fiori rule definition input; CVE-2026-89107 (9.9) S/4HANA Visual Composer code injection; and CVE-2026-89108 (9.1) missing authorization check in Manufacturing Integration and Intelligence allowing admin account creation. SAP reports no exploitation in the wild.

SAP NetWeaverSAP S/4HANASAP Cloud SDK for Python+3

CVE-2026-89111CVE-2026-89110CVE-2026-89107+3

AppSec· Published and added 14 Oct 2026

x.comadvisory🛡️ Security

Dark Web Intelligence (@DailyDarkWeb) on X

Summary of SAP's October 13, 2026 Security Patch Day (16 new notes, 4 GitHub advisories). It leads with CVE-2026-89111, a CVSS 10.0 OAuth2 SSRF in SAP Cloud SDK for Python before 0.45.2, where an attacker-controlled tenant_subdomain redirects token requests and exfiltrates client credentials. It also lists three other critical flaws: broken access control in NetWeaver Visual Composer, code injection in S/4HANA substitution/validation rules, and a missing authorization check in the Manufacturing Integration and Intelligence (XMII) Configuration Service. It notes that none are in CISA KEV and SAP reports no in-the-wild exploitation.

SAP Cloud SDK for PythonSAP NetWeaverSAP S/4HANA+3

CVE-2026-89111CVE-2026-89110CVE-2026-89107+5

AppSec, Identity & Access· Added 15 Oct 2026, published 13 Oct 2026

x.comthread🛡️ Security

Phillip Shoemaker (@pbsIdentity) on X

Social thread reacting to a newly disclosed high-severity OAuth vulnerability in the Model Context Protocol Python SDK, where a malicious MCP server could manipulate the authorization flow and steal credentials used by an agent. The author uses it to argue that delegated agent authority needs provenance (who granted it, to which agent, for which service and resource, whether it is transferable or replayable, and when it expires) and that machine-to-machine trust must be auditable by humans. Gives no CVE ID or technical exploit detail.

Model Context ProtocolPythonOAuth

confused deputy

AI Security, Identity & Access· Added 13 Oct 2026, published 12 Oct 2026

simonkoeck.comwriteup🛡️ Security

I Found a $90k Remote Code Execution Vulnerability in Google

Writeup of an unauthenticated RCE on Google's shared DevSite platform (developers.google.com, firebase.google.com, developer.android.com and others). The Flask session cookie embedded a pickled OAuth2WebServerFlow containing the OAuth client_secret, which was also the Flask SECRET_KEY. That let the author forge signed sessions carrying a malicious pickle that the OAuth callback unpickled; RCE was proven safely with time.sleep timing and negative controls. It earned a $90,000 bounty and lists a four-part fix.

FlaskPythonOAuth+1

Google Bug HuntersDevSitepickle deserialization+3

AppSec, Identity & Access· Published and added 12 Oct 2026

opensourcemalware.comwriteup🛡️ Security

GhostAction Phishing Campaign

OpenSourceMalware analyzes a targeted phishing email from my-github[.]com (same server 193.32.204[.]199 as GhostAction's CI/CD exfiltration) that impersonated a GitHub new-sign-in alert. Recovered HTML and a HAR show a GitHub reverse proxy that captures passwords and TOTP codes, rewrites GitHub subdomains, and injects JavaScript that silently completes an OAuth device flow with repo, workflow and read:org scopes, then exfiltrates the token to TCP/8443. It includes a per-session redirect controller, mutable redirect behavior seen in URLScan, a victim's audit-log outcome (MFA stopped escalation), IOCs, and response guidance.

GitHubOAuthGitHub Actions+2

GhostActionmy-github.com193.32.204.199+6

Threat Intel, Supply Chain, Identity & Access· Published and added 11 Oct 2026

github.comrepo🧠 AI

bilawalsidhu/gods-eye-view

God's Eye View is an open-source, vanilla JavaScript + CesiumJS + Vite 3D globe that fuses live public feeds (aircraft, ships, satellites, quakes, public cameras, weather) into one explorable scene. Its AI layer is a hands-free voice agent on the OpenAI Realtime API with 30 tools: camera fly-to, whiteboard annotations, analyst queries over live layers, and scene-context and screenshot grounding. Keys stay server-side and the browser gets only a short-lived session token. An experimental ChatGPT/Codex OAuth path is also supported. The app doubles as an MCP server, so Claude Desktop, Codex or ChatGPT can open the globe from a conversation.

OpenAI APIModel Context ProtocolCesiumJS+8

God's Eye ViewBilawal SidhuHalfpixel+2

llm-apps, mcp, multimodal· Added 11 Oct 2026

uber.comwriteup🧠 AI

Solving the Identity Crisis for AI Agents (Uber)

Uber's engineering team describes how it extended its Zero Trust stack to give AI agents verifiable identities. Each agent workload gets a SPIRE SVID, and a Security Token Service checks an Agent Registry and mints single-hop, short-lived JWTs. Those tokens carry the full actor chain (for example user → Oncall Agent → Investigation Agent), loosely modelled on OAuth 2.0 Token Exchange (RFC 8693). The tokens are enforced at an MCP Gateway for tool calls, and an AI Gateway fronts model calls with guardrails. The post also covers an A2A client in the SDK that makes the secure path the default, observability of actor chains, and a 2026 roadmap toward dynamic access control and unified policy enforcement. It is a concrete production reference for agent attribution and delegated authorization.

Model Context ProtocolKubernetesSPIFFE+6

UberMichelangeloOpenAI+4

agents, ai-infra, mcp· Added 10 Oct 2026

github.comrepo🧠 AI

Show HN: Let your AI agents paint big arrows, boxes and text on your screen

bigarrow is an MIT-licensed, single-binary Swift macOS CLI that draws a click-through arrow and sign over all windows so an AI agent can show a human where to click, paste or act (permission prompts, 2FA, OAuth consent). It ships an Agent Skills package (installed via `bigarrow install-skill`) for Claude Code and Codex, with JSON output and exit codes, and can target by Accessibility label, coordinates, window or Peekaboo snapshot. The README documents the skill's token cost (182 tokens for the description, 1,398 for the instructions) and 104 automated tests.

SwiftmacOSClaude Code+6

bigarrowNameplatePeter Steinberger+2

coding-agents, prompting, agents· Published and added 9 Oct 2026

x.comthread🛡️ Security

Ned Peterson (@NedPeterson99) on X

A post summarizing a joint FBI and six-country advisory on actors tied to Integrity Technology Group (the sanctioned Chinese firm linked to Flax Typhoon and the Raptor Train botnet). They password-sprayed Microsoft 365 and Exchange accounts over EWS, OWA, ActiveSync and PowerShell with EBurst. They then drained mailboxes with a PHP bot over Exchange Web Services and an office-cli utility using stored client ID, tenant ID and secret values, and exposed the stolen email to third parties through a web app, in some cases restricted to Xiamen IP addresses. Victims were in government, law enforcement, healthcare and religious organizations across Southeast Asia, Africa and North America, with activity since at least January 2021. Defensive takeaways: enforce MFA on every legacy path, retire basic auth and EWS, audit OAuth apps and service principals with mail-read rights, and alert on bulk mailbox pulls.

Microsoft 365Microsoft ExchangeEBurst+3

Integrity Technology GroupFlax TyphoonRaptor Train+3

Threat Intel, Identity & Access· Added 11 Oct 2026, published 9 Oct 2026

vulnerablemcp.infowriteup🧠 AI

ETDI: Comprehensive MCP Security Framework

ETDI (Enhanced Tool Definition Interface) is a proposed security extension to the Model Context Protocol that adds cryptographically signed and versioned tool definitions, OAuth 2.0 scope-based permissions, Cedar-policy-driven context-aware access control (via engines like Amazon Verified Permissions/OPA), and call-stack verification to stop tool chaining and privilege escalation. It is designed to counter two named MCP threat classes — Tool Poisoning (spoofed/impersonated tool definitions) and Rug Pull attacks (post-approval silent modification of tool behavior) — with concrete pseudocode for signature verification, version/integrity checking, and policy evaluation. The page functions as an implementation guide for MCP client/server builders wanting to harden tool approval and invocation flows.

Model Context ProtocolOAuthCedar+1

ETDI

mcp· Added 8 Oct 2026

adversa.aiarticle🛡️ Security

Top MCP security resources — October 2026

Adversa AI's October 2026 MCP security roundup, aggregating and synthesizing 15 resources: authentication-bypass vulnerabilities in LiteLLM's MCP endpoint (CVE-2026-59822, now CISA KEV), Grafana's MCP server session spoofing/SSRF (CVE-2026-19516), an MCP Python SDK OAuth-fallback flaw exploited by a malicious server returning a 404, and an Obot gateway route-matching bypass reopening GHSA-vw82. It also covers detection failures (two malicious MCP servers passing five scanners including Cisco mcp-scanner and Snyk agent-scan, 12% of 82,000 public MCP configs hardcoding secrets), a malicious npm wallet-signing package (gadgethumans-mcp), the A2M agent-hijacking attack technique, and CoSAI's MCP Security v2.0 governance model.

Model Context ProtocolLiteLLMnpm+3

CVE-2026-59822CVE-2026-59821CVE-2026-19516+6

AI Security, AppSec, Identity & Access· Published and added 8 Oct 2026

vulnerablemcp.infowriteup🛡️ Security

ETDI: Comprehensive MCP Security Framework

ETDI (Enhanced Tool Definition Interface) is a proposed security extension to the Model Context Protocol that defends against Tool Poisoning (spoofed/impersonated tool definitions) and Rug Pull attacks (silent post-approval modification of tool behavior) using cryptographic signing of tool definitions, immutable versioning with mandatory re-approval, OAuth 2.0 scopes, and Cedar/Amazon Verified Permissions-based policy-aware access control. The page includes detailed attack scenarios, a call-stack verification scheme to prevent tool-chaining privilege escalation, and implementation code for key management, signature verification, and policy evaluation.

Model Context ProtocolOAuthETDI+2

Tool PoisoningRug Pull attackCall Stack Verification

AI Security· Added 8 Oct 2026

github.comrepo🧠 AI

Zhenyu98/codex-chatgpt-bridge

codex-chatgpt-bridge is a Codex agent skill plus external PowerShell control scripts (On/Off/Reboot/Rotate) built on top of the open-source DevSpace MCP bridge, which lets ChatGPT act as a planning/review "architect" while Codex stays the local executor that applies and verifies changes. It adds a token-saving router (NORMAL / TOKEN_SAVING / CHATGPT_ARCHITECT modes) and a lifecycle layer — Cloudflare Quick Tunnels or a stable Cloudflare Worker proxy, DPAPI-protected credentials, OAuth token rotation, and a scheduled-task recovery entrypoint — so the bridge's public endpoint can be closed when idle without re-authorizing the ChatGPT app on every restart.

Model Context ProtocolCodexChatGPT+5

coding-agents, mcp· Added 5 Oct 2026

x.comthread🛡️ Security

Jan Curn (@jancurn) on X

Announcement of mcpc v0.7.0, Apify's open-source MCP CLI client (npm i -g @apify/mcpc), which adds support for the MCP Skills extension with new skills-list/skills-get commands that verify SKILL.md and supporting files against the skill manifest via size and SHA-256 checks before printing content. The release also ships security hardening: repo-local .mcp.json auto-discovery can no longer read environment variables (blocking leaks like $GITHUB_TOKEN), OAuth refresh tokens are now scoped only to the auth server originally used, and Windows login URLs no longer launch through cmd.exe.

Model Context ProtocolOAuthnpm

AI Security, Identity & Access· Added 5 Oct 2026, published 3 Oct 2026

x.comthread🧠 AI

Jan Curn (@jancurn) on X

Jan Curn announces mcpc v0.7.0, an open-source MCP CLI client (npm package @apify/mcpc), adding support for the MCP Skills extension via new skills-list and skills-get commands that fetch and cryptographically verify SKILL.md and supporting files against the skill manifest (size + SHA-256). The release also hardens security by preventing repo-local .mcp.json auto-discovery from reading environment variables (blocking token-leak tricks), scoping refresh tokens to the originating auth server, and fixing an insecure Windows login URL launch path via cmd.exe, alongside OAuth session longevity fixes and 2026-07-28 MCP spec compatibility improvements.

Model Context ProtocolNode.jsOAuth

Jan CurnApifymcpc

mcp· Added 5 Oct 2026, published 3 Oct 2026

github.comrepo🧠 AI

Folkbench/folkbench

Folkbench has two parts. One is a public benchmark and leaderboard of third-party AI API relay (中转站) services. Multi-node probes run around the clock and publish availability, P95 latency and price per relay, with per-model rankings. The other is Switch, an open-source Tauri/Rust desktop client that stores several Base URL and API Key pairs. It applies them to Claude Code or Codex configs in one click, previews config diffs, and stashes and restores the official ChatGPT OAuth credentials when switching Codex to a third-party provider. It also keeps keys local and estimates token usage and cost per session. The README also profiles several relay services, such as Modelflare, CheapAI and ApiPorter, and that part reads as promotional.

TauriRustClaude Code+5

FolkbenchSwitchChatGPT+8

evals, ai-infra, coding-agents· Added 12 Oct 2026, published 2 Oct 2026

x.comtool🛡️ Security

Python Hub (@PythonHub) on X

TATS is an open-source Python tool that analyzes OAuth 2.0, OpenID Connect, and Microsoft Entra ID tokens. It helps security researchers trace authentication flows, identify risky permissions granted to tokens, and visualize token lifecycles for identity security review and investigation work.

PythonOAuthOIDC+1

TATS

Identity & Access· Published and added 2 Oct 2026

github.comadvisory🧠 AI

MCP TypeScript SDK v2.2.0

Release notes for v2.2.0 of the official Model Context Protocol TypeScript SDK. Upgrade notes: machine-to-machine OAuth providers (ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider, CrossAppAccessProvider) should now be given expectedIssuer, and fetchToken() throws AuthorizationServerMismatchError when client information is bound to a different authorization server. listTools/listPrompts/listResources/listResourceTemplates now follow nextCursor automatically, capped by listMaxPages. Fixes include CommonJS type-checking of the DPoP jose types, unhandled rejections in Client.listen(), createMcpHandler stack overflow and subscriptions/listen handling, .localhost loopback for OAuth token endpoints, and v1-to-v2 codemod comment preservation.

Model Context ProtocolTypeScriptOAuth+1

mcp· Added 1 Oct 2026

openid.netpaper🧠 AI

Identity Management for Agentic AI [pdf] (2025)

A whitepaper from the OpenID Foundation, led by Tobin South with contributors from WorkOS, Stanford's Loyal Agents Initiative, and the Artificial Intelligence Identity Management Community Group, mapping how authentication and authorization standards apply to AI agents. It surveys current fixes (OAuth 2.1, Model Context Protocol authorization, enterprise SSO/SCIM provisioning, IPSIE profiles) and lays out unsolved problems for autonomous agents: delegated "on-behalf-of" identity versus user impersonation, consent fatigue at scale, recursive sub-agent delegation, multi-user shared agents, and browser/computer-use agents that bypass API-based authorization entirely.

Model Context ProtocolOAuthSCIM

OpenID FoundationTobin SouthWorkOS+7

mcp, agents, ai-policy· Added 2 Oct 2026, published 1 Oct 2026

openid.netpaper🛡️ Security

Identity Management for Agentic AI [pdf] (2025)

OpenID Foundation whitepaper (Oct 2025, lead editor Tobin South) analyzing how authentication/authorization for AI agents differs from traditional software clients. It covers where OAuth 2.1, OIDC, SSO/SCIM, and MCP already work for single-domain synchronous agents, and lays out unsolved problems for autonomous agentic identity: agent identity fragmentation across vendors, replacing user impersonation with explicit delegated "on-behalf-of" authority, consent-fatigue at scale, recursive delegation chains between sub-agents, agents acting for teams of users, and browser/computer-use agents bypassing API-based authorization entirely.

Model Context ProtocolOAuthOIDC+2

IPSIEOpenID FoundationLoyal Agents Initiative

Identity & Access, AI Security· Added 2 Oct 2026, published 1 Oct 2026

github.comother🛡️ Security

MCP Python SDK v2.2.0

Release notes for MCP Python SDK v2.2.0 detailing several security-relevant default changes: HTTP clients (Client, streamable_http_client, sse_client) now only follow redirects within the same origin, closing a cross-origin redirect trust gap; OAuth clients now validate the authorization server's issuer even on the legacy (non-protected-resource-metadata) discovery path, preventing metadata/issuer mismatch attacks; idle Streamable HTTP sessions now expire after 30 minutes with a 10,000-session cap to limit resource exhaustion; and a new AuthSettings.validate_token_resource setting lets servers reject bearer tokens not issued for them (audience/resource confusion). Deprecation warnings push OAuth provider configs toward requiring an explicit issuer ahead of a 3.0 breaking change.

Model Context ProtocolPythonOAuth

MCPDeprecationWarning

Identity & Access, AppSec, AI Security· Added 27 Sep 2026

github.comrepo🧠 AI

MCP Python SDK v2.2.0

Release notes for MCP Python SDK v2.2.0, the reference Python implementation of the Model Context Protocol. Key changes: HTTP client redirects are now restricted to the same origin as the endpoint, idle Streamable HTTP sessions expire after 30 minutes (with a 10,000-session cap), OAuth authorization server metadata issuer checks are now enforced on the legacy discovery path, and new deprecation warnings push toward requiring explicit `issuer=` and `validate_token_resource` settings ahead of a 3.0 release.

Model Context ProtocolPython

mcp· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-49291: mcp-memory-service is a semantic memory layer for AI applications

CVE-2026-49291 affects mcp-memory-service prior to version 10.65.3: its HTTP MCP JSON-RPC endpoint at /mcp only enforced OAuth 'read' scope before dispatching tools/call requests, so a client holding only read access could invoke mutating tools like store_memory and delete_memory even though the equivalent REST endpoints correctly required 'write' scope. The flaw is a classic missing-authorization bug (CWE-862) surfacing specifically in an MCP tool-dispatch layer, scored CVSS 3.1 8.1 (High) with confidentiality unaffected but integrity and availability impacted. Fixed in 10.65.3.

Model Context ProtocolOAuth

CVE-2026-49291CWE-862

AppSec, Identity & Access· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-18655: Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs

CVE-2026-18655 describes an improper endpoint restriction flaw (CWE-923) in the RabbitMQ broker connection tools of awslabs.amazon-mq-mcp-server versions before 2.0.24. A remote unauthenticated attacker can use prompt injection introduced into the MCP client context to redirect the broker hostname to an attacker-controlled endpoint, causing Amazon MQ for RabbitMQ credentials or OAuth access tokens to be sent there; CVSS 4.0 base score 7.1 (High). Fixed in version 2.0.24, referenced via an AWS security bulletin and a GitHub security advisory (GHSA-xwj6-8x5h-hjp6).

Model Context ProtocolAWSAWS Bedrock+1

CVE-2026-18655CWE-923GHSA-xwj6-8x5h-hjp6

AI Security, Cloud & Infra· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-14541: An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mc

CVE-2026-14541 describes an authentication bypass (CWE-287) in the Google OAuth provider of Google's mcp-toolbox for databases v1.4.0, an MCP server that lets LLM agents query databases. When the Google authService is configured with mcpEnabled: true but no explicit audience or clientId, the ValidateMCPAuth pipeline skips audience checks for opaque tokens, so any valid Google OAuth access token — even one issued for an unrelated app — is accepted, letting unauthorized clients reach protected tools and data backends.

Model Context ProtocolOAuthGoogle Cloud

CVE-2026-14541CWE-287

Identity & Access, AI Security· Added 26 Sep 2026

github.comadvisory🛡️ Security

Insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

GHSA advisory for better-auth (< 1.6.11) documenting that the deprecated oidcProvider() and mcp() plugins publish "none" as a supported ID-token signing algorithm in their OIDC discovery document and default allowPlainCodeChallengeMethod to true, silently rewriting missing code_challenge_method to "plain" — both violating OAuth 2.1/RFC 9700. The fix removes "none" from the metadata, defaults plain PKCE to disabled, and rejects requests missing code_challenge_method instead of downgrading them; @better-auth/oauth-provider was never affected.

better-authOIDCOAuth

PKCERFC 9700OAuth 2.1

Identity & Access· Added 26 Sep 2026

github.comadvisory🛡️ Security

CVE-2026-44895 - GitHub Advisory Database

GitHub advisory for @yoda.digital/gitlab-mcp-server (mcp-gitlab-server): with USE_SSE=true the HTTP/SSE transport has no authentication, sends wildcard CORS headers, and binds to 0.0.0.0. Any network caller or any web page the operator visits can open /sse and POST /messages to drive all 86 GitLab tools (delete_repository, push_files, etc.) using the operator's personal access token. It includes a curl PoC, a CVSS 4.0 vector (~6.3 Medium, effectively High when SSE is enabled) and four fixes: required auth token, loopback bind, a CORS allowlist, and the OAuth roadmap.

Model Context ProtocolGitLabNode.js+2

CWE-306CVSS 4.0

AI Security, AppSec· Added 26 Sep 2026

arxiv.orgpaper🛡️ Security

A First Measurement Study on Authentication Security in Real-World Remote MCP Servers

The first large-scale measurement study of authentication security across real-world remote MCP servers, scanning 7,973 live deployments and finding 40.55% expose tools with no authentication at all. For the 119 testable OAuth-enabled servers, the authors built a semi-automated (passive traffic inspection + active dynamic probing) detection framework and derived a taxonomy of nine flaw types across four categories — three MCP-specific (open client environments, dynamic client registration, delegated authorization) and conventional OAuth misconfigurations — finding every tested server had at least one flaw, with dynamic client registration flaws hitting 96.6% of servers and leading to information leakage or account takeover; the work resulted in 9 CVEs via responsible disclosure.

Model Context ProtocolOAuth

Identity & Access, AI Security· Added 26 Sep 2026

wiz.iowriteup🛡️ Security

The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments

Wiz Research analyzed infostealer-harvested secrets (via its NordStellar integration) to map exactly which credentials malware families like Lumma, RedLine, and Vidar target across AWS, Azure, GCP, GitHub, GitLab, and AI platforms, and how those secrets translate into cloud account takeover. It gives concrete file paths and artifacts attackers hunt for (~/.aws/sso/cache OIDC tokens, Azure accessTokens.json, GCP credentials.db/access_tokens.db, GitHub gh hosts.yml and SSH keys, GitLab Runner config.toml, OpenAI/ChatGPT session cookies, and Claude Code's ~/.claude/.credentials.json OAuth tokens), plus stats: three malware families cause 85.7% of incidents, AWS/GCP account for 46%/13% of stolen secrets, GitHub ~10%, AI platforms ~5%. It also covers CI/CD-targeting infostealers (Miasma, TeamPCP) and session-cookie hijacking as an MFA bypass technique.

AWSAzureGCP+3

CVE-2023-7028LummaRedLine+11

Threat Intel, Cloud & Infra, Identity & Access· Added 27 Sep 2026, published 25 Sep 2026

labs.watchtowr.comwriteup🛡️ Security

Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)

CVE-2026-94127 is an unauthenticated heap overflow in F5 BIG-IP's APM OAuth userinfo handler (tmm). A 0x4100-byte heap buffer receives the Authorization header with no length check. watchTowr patch-diffed 21.1.0 against 21.1.0.2 with Diaphora, triggered a crash via /f5-oauth2/v1/userinfo, and described a ret2plt chain that works around SELinux by appending a command to /etc/bigstart/scripts/tmm.finish.

F5 BIG-IPTMOSDiaphora+2

CVE-2026-94127watchTowrK000162605+4

Offensive Security, Malware & RE, AppSec· Added 30 Oct 2026, published 23 Sep 2026

socket.devwriteup🛡️ Security

Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts

Socket's Threat Research team dissects a malicious Firefox extension (pdf-para-texto@extensao.local, "PDF Identity Verifier") that ships with no hardcoded malicious code — all attack logic is fetched as data into browser.storage.local after install via a lookalike domain (pdf.gusercontent.com), evading static store review. Once armed, it abuses Google's FedCM API to silently identify the victim, injects a live automation script into real accounts.google.com pages to drive an invisible account-takeover flow (bypassing password entry, forcing passkey challenges, dodging Google's bot detection, and forcing/capturing a password reset), while a webRequest listener steals the oauth_token session cookie from Set-Cookie headers — giving the attacker both a live session and a durable new password. The campaign targets Portuguese- and Spanish-speaking users starting September 2026 and includes full IOCs (domains, file hashes) and remediation steps.

FirefoxSocketOAuth

pdf-para-texto@extensao.localpdf.gusercontent.com

Supply Chain, Threat Intel, Identity & Access· Published and added 23 Sep 2026

huntress.comwriteup🛡️ Security

OAuth Token Theft Through Microsoft's Front Door | Huntress

Huntress researcher Andrew Schwartz demonstrates a novel OAuth token-theft technique: a sideloaded AppX package registered via Add-AppxPackage -Register (requiring only Developer Mode, no admin beyond that toggle) can set ContentUriRules WindowsRuntimeAccess="all" so attacker-controlled JavaScript rendered inside the Microsoft-signed WWAHost.exe process gets full WinRT access, including the legacy WebAuthenticationBroker OAuth API. Using Microsoft Office's own client ID and the oob redirect URI, the attacker triggers a genuine login.microsoftonline.com/MFA dialog with no browser chrome, captures the auth code, and exchanges it for an access token plus a long-lived refresh token carrying the full Office delegated Graph scope set (mail, files, Teams, directory, AuditLog.Create) — validated end-to-end against a live Entra ID tenant with MFA and default Conditional Access. The post frames it as a class of vulnerable signed AppX host binaries sharing the same WinRT activation layer, and provides a Sigma rule keyed on the MSAppHost/3.0 EdgeHTML user agent reaching non-Microsoft destinations, plus Sysmon/Event ID and GPO-based mitigations (restricting Developer Mode, Conditional Access, shorter refresh-token lifetimes, CAE).

WindowsOAuthMicrosoft Entra ID+4

WWAHost.exeWebAuthenticationBrokeraskWAM+8

Identity & Access, Offensive Security, Blue Team & Detection· Published and added 23 Sep 2026

tenetsecurity.aiwriteup🛡️ Security

Static Defenses vs. Dynamic Exploits: Why A2AS Fails at the Runtime

Tenet Threat Labs red-teamed a GPT-4o agent with all five A2AS BASIC pillars enabled and an MCP server. A tool response disguised as HTTP 206 pagination and OAuth steps ("Tool Parameter Injection via Semantic Orchestration Mimicry") led the agent to run a shell script, read credentials.txt and exfiltrate the token. It succeeded in over 80% of runs in November 2025. The authors argue for runtime enforcement based on content trust levels.

Model Context ProtocolGPT-4oA2AS

Tool Parameter Injection via Semantic Orchestration Mimicryprompt injectionindirect prompt injection+1

AI Security· Added 29 Oct 2026, published 23 Sep 2026

rapid7.comadvisory🛡️ Security

CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM

Rapid7's ETR writeup covers CVE-2026-94127, a critical heap-based buffer overflow (CVSS 9.8) in F5 BIG-IP Access Policy Manager that allows unauthenticated remote code execution via crafted traffic. Exploitation requires a virtual server with both an APM access policy and an OAuth profile configured, affects the data plane (including Appliance mode), and has been added to CISA KEV; F5 provides hotfixes for the 21.1.0, 17.5.0, and 17.1.0 release trains plus an iRule workaround for those unable to patch immediately.

F5 BIG-IPCVSSCISA KEV+1

CVE-2026-94127

Cloud & Infra, Identity & Access· Added 7 Oct 2026, published 23 Sep 2026

github.comrepo🛡️ Security

https://github.com/akha-security/akca

AKCA is an open-source, Go-based Dynamic Application Security Testing (DAST) scanner that combines HTTP and headless-browser crawling, JavaScript/AST analysis, API spec import (OpenAPI, GraphQL, gRPC, etc.), and adaptive active testing across a very broad set of vulnerability classes including SQL injection, XSS, SSRF, IDOR/BOLA, SSTI, JWT/OAuth flaws, race conditions, and cloud/CI exposure. It emphasizes evidence-oriented verification — replaying promising signals against baselines, negative controls, and OAST callbacks before promoting them to findings — and exports Burp-style HTTP evidence in HTML, JSON, CSV, Markdown, and SARIF reports. Positioned as a transparent, single-developer alternative inspired by but not claiming parity with Acunetix, Invicti/Netsparker, or Burp Suite Professional.

GoBurp SuiteSARIF+3

IDORBOLASSRF+1

AppSec· Added 2 Oct 2026, published 23 Sep 2026

bex.coarticle🛡️ Security

30+ MCP CVEs in Two Months: What the Early-2026 Vulnerability Wave Means for Your MCP Supply Chain

Analysis of 30+ CVEs filed against Model Context Protocol servers, clients, SDKs, and proxies in the first two months of 2026, showing the flaws concentrated in plumbing (proxies, registries, transports) rather than tool implementations. It walks through CVE-2025-6514 (CVSS 9.6 RCE in mcp-remote via unsanitized OAuth authorization_endpoint URLs shelled out to launch a browser), the chained Atlassian MCP server CVEs (CVE-2026-27825/CVE-2026-27826), unauthenticated public registries, and a systemic stdio-transport advisory, then ties the findings to the NSA's May 2026 MCP security CSI and the OWASP MCP Top 10.

Model Context Protocolmcp-remoteClaude Desktop+3

CVE-2025-6514CVE-2026-27825CVE-2026-27826+5

AI Security, Supply Chain, AppSec· Added 26 Sep 2026, published 23 Sep 2026

uber.comarticle🛡️ Security

Solving the Identity Crisis for AI Agents (Uber)

Uber describes how it extended its Zero Trust stack to give AI agents verifiable identities: workloads get SPIRE SVIDs, an Agent Registry validates agent-to-workload binding, and a Security Token Service mints single-hop, short-lived JWTs (based on OAuth 2.0 Token Exchange, RFC 8693) that embed the full actor chain from human to agents. An MCP Gateway enforces tool-level policy and an SDK-integrated A2A client makes secure propagation the default. It addresses delegation, provenance loss across agent hops, and auditability, and notes alignment with IETF WIMSE drafts.

Model Context ProtocolSPIFFESPIRE+3

RFC 8693IETF WIMSEdraft-klrc-aiagent-auth-01+7

Identity & Access, AI Security· Added 18 Sep 2026

github.comrepo🛡️ Security

AI Agent Hacking Writeups

A GitHub-hosted, CC0-licensed index of 281 public writeups on attacks against AI agents, organized into six categories: indirect prompt injection, direct prompt injection/jailbreaks/guardrail bypass, MCP and agent tooling, AI platform/infrastructure bugs, classic web bugs in AI product surfaces, and AI used as an attacker's tool. Entries span 2021-2026 and include major disclosures like GeminiJack, ForcedLeak, Clinejection, CVE-2025-53773 (GitHub Copilot RCE), and dozens of Johann Rehberger/PromptArmor/qual1a writeups covering exfiltration, MCP OAuth flaws, and coding-agent sandbox escapes. Comes with an accompanying blog post "How to Hack AI Agents" and a scripted links.txt for automation.

Claude CodeModel Context ProtocolGitHub Copilot+17

CVE-2026-24299CVE-2025-66032CVE-2025-62453+25

AI Security· Added 22 Sep 2026, published 17 Sep 2026

securitylabs.datadoghq.comwriteup🛡️ Security

Threat Hunter's Guide to GitHub (Datadog Security Labs)

Datadog Security Labs walks through hunting for GitHub organization compromise using GitHub audit logs, covering the full attack chain from stolen PATs/OAuth tokens and device-code phishing (initial access) through secrets-listing enumeration, private-repo/tree discovery, and bulk collection via git.clone or repo.download_zip. It provides copy-pasteable queries (with fields like hashed_token, programmatic_access_type, external_identity_nameid) mapped to MITRE ATT&CK techniques and calls out GitHub audit-log quirks (missing IP on failed auth, inconsistent visibility fields, misleading token permission scopes) that shape accurate detections.

GitHubMITRE ATT&CKOAuth+2

T1078T1528T1552+2

Blue Team & Detection, Identity & Access· Added 25 Sep 2026, published 16 Sep 2026

huntress.comwriteup🛡️ Security

Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware

Huntress SOC analysts Ryan Dowd and Jon Semon tore apart a live social-engineering campaign that began with a fake CoinDesk marketing exec DMing a researcher a Google Doc containing a container-bound Apps Script sidebar. The script ran client-side without OAuth consent, exfiltrated victim IP/geolocation/wallet presence via the Telegram API, then routed macOS users to a piped zsh/DMG AMOS stealer chain and Windows users through ClickOnce and PowerShell loaders using three stolen or fraudulent code-signing certificates (a Norwegian company, Discord, and Lenovo). The Windows chain culminated in NetSupport Manager RMM abuse, a Ledger wallet implant, and a self-generated rogue root certificate authority (spoofing Google Trust Services) installed via MsBuild.exe hollowing to silently intercept HTTPS traffic, which the authors flag as the artifact most likely to survive incident remediation short of full reimaging.

WindowsmacOSGoogle Workspace+3

AMOS stealerClickFixMacSync+6

Threat Intel, Malware & RE· Added 11 Sep 2026, published 15 Sep 2026

socket.devwriteup🛡️ Security

Socket: "JeetBot" Twitch Extension Steals 31,000 Users' OAuth Tokens

Socket's Threat Research Team analyzed "Twitch Enhanced Viewer | JeetBot", a Chrome/Firefox extension with 31,000 users that captures the user's live Twitch OAuth session token from the Authorization header and forwards it as an &auth= query parameter to proxy servers operated by JeetBot, a Russian-language Twitch/Kick/VK-Live bot SaaS, exempting only ten hardcoded Russian streamer channels. Earlier v4.x builds POSTed tokens outright to dedicated set-token endpoints (with backups on deno.dev/deno.net) and included Russian-language comments indicating deliberate rate-limited exfiltration; the account-scoped bearer token grants chat, whispers, and settings access, contradicting both store listings' "no data collection" claims. Firefox has since shipped a fix (85.8.7) after Socket's disclosure; the Chrome build remained vulnerable at publication.

ChromeFirefoxOAuth+3

JeetBotPopov Aleksandr AlekseevichHISHIMIRO+4

Threat Intel, Identity & Access· Published and added 12 Sep 2026

github.comrepo🧠 AI

punkpeye/awesome-remote-mcp-servers

Awesome Remote MCP Servers is a curated GitHub list of hosted Model Context Protocol servers that you connect to by URL, with no local install. Entries are listed only after the endpoint answers an MCP initialize handshake. It explains local versus remote servers, shows connection examples for Claude Code and mcp.json, marks auth as none, API key or OAuth, and groups servers into about 40 categories.

Model Context ProtocolClaude CodeCursor+7

GlamapunkpeyeZapier+3

mcp· Added 2 Nov 2026, published 8 Sep 2026

huntress.comarticle🛡️ Security

Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress

Huntress details five modern phishing techniques that bypass traditional "check the URL" training and MFA: ClickFix (fake CAPTCHA tricking users into running Win+R/paste commands to execute malware), Browser-in-the-Browser (fake HTML popup windows mimicking OAuth login prompts with forged address bars/padlocks), ConsentFix (dragging an identity icon to leak an OAuth authorization code that attackers trade for Microsoft Entra ID access/refresh tokens), device code phishing (abusing the legitimate microsoft.com/devicelogin flow to authorize an attacker's device via a code, seen weaponized in PhaaS kits like EvilTokens), and fake video-conference (Teams/Zoom/Google Meet) waiting-room overlays that push a malicious "driver update" install. Each section explains why the technique defeats standard security-awareness training and how Huntress's simulated phishing scenarios replicate it.

OAuthMicrosoft Entra IDMicrosoft 365

ClickFixEvilTokensBrowser-in-the-Browser+2

Offensive Security, Identity & Access· Added 3 Sep 2026, published 28 Aug 2026

docs.gitlab.comarticle🧠 AI

GitLab 19.3 release

GitLab 19.3 release notes cover dozens of features, with a significant cluster around AI agent tooling: a new "Flow Creator" foundational agent that generates runnable flow YAML for the GitLab Duo Agent Platform from natural language, GitLab Duo CLI plugin/marketplace support (compatible with existing Claude Code plugin marketplace files), new MCP tools (get_merge_request, list_merge_requests), pre-registered MCP OAuth applications, and a redesigned Agentic Chat UI for VS Code/JetBrains. It also ships GA features for Duo-based merge-conflict and review-discussion resolution, and security/SAST features like Agentic SAST vulnerability resolution flows.

Model Context ProtocolClaude CodeGitLab Duo CLI+2

GitLabGitLab DuoGitLab Duo Agent Platform+4

coding-agents, agents, mcp· Added 22 Sep 2026, published 27 Aug 2026

blog.modelcontextprotocol.ioarticle🧠 AI

The New MCP Roadmap

The Model Context Protocol Core Maintainers publish an updated roadmap covering five priority areas: agentic messaging primitives (server-initiated events, maturing the Tasks extension SEP-2663), HTTP-native transport unification (including local servers over Streamable HTTP/stdio), agent identity and enterprise security (DPoP, Workload Identity Federation, ID-JAG grant, token exchange, engagement with IETF OAuth and WIMSE working groups), improved tool-call result primitives and progressive tool discovery, and SDK developer experience. It also recaps the previous roadmap's shipped work in the 2026-07-28 spec release — removal of protocol-level sessions/handshake for stateless horizontal scaling, server/discover, cacheable list results, Multi Round-Trip Requests (SEP-2322), issuer validation, issuer-bound client credentials, and Client ID Metadata Documents (CIMD).

Model Context ProtocolOAuth

IETFWIMSE

mcp· Added 7 Oct 2026, published 22 Aug 2026

blog.modelcontextprotocol.ioarticle🛡️ Security

The New MCP Roadmap

Official blog post from the Model Context Protocol Core Maintainers laying out the updated project roadmap, with a significant authorization/identity component: it recaps the 2026-07-28 spec release's security work (issuer validation, issuer-bound client credentials, Client ID Metadata Documents as the preferred client registration path, and a now-stable Enterprise-Managed Authorization extension) and names "Agent identity and enterprise-ready security" as a top priority going forward. That upcoming work covers finalizing DPoP, defining agent identity and delegation through Workload Identity Federation, the ID-JAG grant, and standard token exchange, plus deeper engagement with the IETF OAuth and WIMSE standards groups — aimed at moving MCP server authorization away from long-lived API keys toward cryptographically bound, delegated agent identities.

Model Context ProtocolOAuth

DPoPWorkload Identity FederationID-JAG+4

Identity & Access· Added 8 Oct 2026, published 22 Aug 2026

jfrog.comarticle🛡️ Security

JFrog: Propagating User Identity From AI Agents to Your Tools

JFrog explains how to propagate end-user identity across the 'second hop' when AI agents call tools through Amazon Bedrock AgentCore Gateway, focusing on On-Behalf-Of (OBO) token exchange to authenticate to JFrog Artifactory as the actual user rather than a shared service credential. It compares OBO against header whitelisting and three-legged OAuth, explaining why shared credentials break audit fidelity, least privilege, and containment for agentic systems, and provides a CLI-driven procedure to configure OBO between AgentCore Identity and Artifactory's MCP server.

JFrog ArtifactoryModel Context ProtocolAmazon CloudWatch+1

Amazon Bedrock AgentCore GatewayAgentCore Identity

AI Security, Identity & Access· Published and added 21 Aug 2026

cloud.google.comarticle🛡️ Security

Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

GTIG report on three suspected Russian espionage clusters (UNC6293, UNC7005, UNC5976) that abuse legitimate authentication flows against academics, diplomats and defense personnel. It covers app password, OAuth and device code phishing, WhatsApp device linking, VIDAR and ATOMIC stealers, ENGINELIGHT, HEADRUSH and the hospitality captive portal campaign. It links UNC6293 and UNC7005 to ICE RELIC (formerly APT29) with moderate confidence and gives hardening advice.

OAuthWhatsAppGoogle Workspace+3

UNC6293UNC7005UNC5976+18

Threat Intel, Identity & Access· Added 29 Oct 2026, published 20 Aug 2026

varonis.comwriteup🛡️ Security

CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower (CVE-2026-24301)

Varonis Threat Labs details CoSnitch (CVE-2026-24301), a chain of three flaws in Microsoft Copilot Personal. A crafted copilot.microsoft.com link with ?q= and an undocumented autorun parameter runs a prompt on load. That prompt reads data through OAuth connectors (Gmail, Drive, Calendar) and exfiltrates it via Copilot's URL-fetch to an attacker webhook. Indirect prompt injection through web summarization also writes persistent attacker instructions into Copilot's memory. The post also describes "meta-hacking", where researchers got Copilot to disclose its own hidden parameter, and lists mitigations.

Microsoft CopilotOAuthGmail

CVE-2026-24301CoSnitchmeta-hacking+3

AI Security, AppSec· Added 5 Sep 2026, published 18 Aug 2026

wiz.iowriteup🛡️ Security

Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR

Wiz's autonomous "Red Agent" discovered a GitHub Actions script-injection vulnerability in snowflakedb/snowflake-connector-net's jira_issue.yml workflow, introduced when a PR (co-authored by GitHub Copilot) replaced a safe env:/jq pattern with direct interpolation of the attacker-controlled issue title. GitHub Advanced Security scanned the same PR and workflow but failed to flag the injection; Red Agent autonomously crafted and self-corrected a payload after a bash syntax error, exfiltrated Jira OAuth credentials via an out-of-band callback, and used them to access Snowflake's internal Jira (engineering, security, and bug-bounty projects) — all without human intervention. Snowflake patched and rotated credentials the same day the flaw was reported via HackerOne.

GitHub ActionsGitHub Advanced SecurityGitHub Copilot+3

Red AgentWiz Research

DevSecOps, AI Security, Offensive Security· Added 3 Sep 2026, published 17 Aug 2026

github.comrepo🛡️ Security

Recon-Skills

Recon-Skills is a curated collection of SKILL.md playbooks for external web security assessments, organized into auth (SSO/OAuth/SAML/MFA), chains (multi-step attack-path analysis), infra, recon (subdomain/DNS/port/tech discovery, route/parameter/API mapping), and redteam (vulnerability-class and platform-specific validation) categories. Each skill documents prerequisites, procedure, pitfalls, and verification criteria, and the skills are designed to be followed manually or loaded as task context by an automation system for authorized penetration testing engagements. It includes a validator script (validate_skills.py) and style/contribution guides to maintain a consistent quality baseline across skills.

OAuthGraphQLKubernetes

Offensive Security, AppSec, OSINT· Published and added 29 Jul 2026

huntress.comarticle🛡️ Security

How the LSHIY Password-Spraying Attack Abuses OAuth’s ROPC Grant

Huntress blog recap of a Tradecraft Tuesday broadcast breaking down the LSHIY password-spraying campaign, which hit Microsoft Azure CLI tenants via IPv6 ranges from BYOIP provider LSHIY LLC, generating over 81 million login attempts and 78 account compromises in a two-week window. The campaign abuses OAuth's deprecated Resource Owner Password Credentials (ROPC) grant at the tenant token endpoint to mint delegated tokens that bypass MFA and Conditional Access Policies when valid credentials are entered. After LSHIY's takedown the actor pivoted to FranTech IPv6 ranges and Tor exit nodes; mitigations include disabling ROPC, restricting Azure CLI for non-admins, and enforcing unscoped Conditional Access covering all users, apps, and client types.

OAuthAzure CLIMicrosoft Entra ID+2

LSHIY LLCFranTech3xK Tech+2

Threat Intel, Identity & Access· Added 3 Sep 2026, published 22 Jul 2026

github.comrepo🧠 AI

yolorouter/yolorouter

Yolorouter is a free, self-hosted, single-binary LLM gateway that translates between the four major chat wire protocols — OpenAI Chat Completions, OpenAI Responses, Anthropic Messages, and Gemini generateContent — so a client built for one provider (e.g. Claude Code) can be pointed at any other. It adds multi-provider failover, round-robin upstream API key pooling with rate-limit/quota handling, per-key budgets and access control, a multi-user admin console with OAuth2/OIDC SSO, and native image/video generation support for OpenAI-shaped and non-OpenAI-shaped providers (DashScope, Volcengine Ark, Kling, MiniMax). It also ships cost-optimization features — deterministic system-prompt injection and tool-output compression for coding agents — backed by a published benchmark, plus built-in usage/cost observability.

DockerGoSQLite+4

YolorouterOpenAIAnthropic+11

ai-infra· Added 2 Oct 2026, published 21 Jul 2026

discuss.circleci.comadvisory🛡️ Security

Security notice and deprecation: standalone circleci-mcp-server

CircleCI disclosed GHSA-8xjg-jpfh-5257 affecting its standalone circleci-mcp-server npm package used as an MCP server in Claude Desktop, Cursor, VS Code, and Windsurf, and is deprecating that package in favor of a built-in MCP server shipped with a new CircleCI CLI. Affected users are told to upgrade to version 0.19.0 immediately, while CircleCI cloud users are pointed toward migrating to the CLI, which adds OAuth-based auth and native pipeline watching. CircleCI will keep shipping security patches to the old package but is no longer adding features to it.

Model Context ProtocolnpmClaude Desktop+3

GHSA-8xjg-jpfh-5257

AI Security, Supply Chain· Added 22 Aug 2026, published 20 Jul 2026

github.comrepo🛡️ Security

Gabson0x/pentdem

pentdem is an autonomous AI-powered pentesting CLI/pipeline that fans out 15+ vulnerability-class hunters (XSS, SQLi, SSRF, IDOR, SSTI, JWT, GraphQL, etc.) and 8 advanced attack skills (mass assignment, race conditions, cloud metadata, OAuth/OIDC, subdomain takeover, credential harvesting) in parallel, using an LLM to adapt strategy mid-scan. It wraps real tools (nmap, sqlmap, nuclei, ffuf, subfinder, httpx) in Docker isolation and adds a novel gate chain — quality gate, kill-chain builder, adversarial cross-model validation (a second model tries to disprove each finding), a capability execution ledger (proves each hunter actually ran instead of silently crashing), and a ship-discipline gate — before mapping surviving findings to MITRE ATT&CK/OWASP Top 10/CVSS and generating reports.

DockerPythonsqlmap+3

Offensive Security, AI Security· Published and added 20 Jul 2026

advisories.gitlab.comadvisory🛡️ Security

AI Security Briefing

CVE-2026-50027 describes a critical missing-authentication flaw in mcp-memory-service, a PyPI-hosted MCP server used for persistent AI agent memory. All routes under /api/documents/* bypass the server's MCP_API_KEY/OAuth authentication checks (unlike the properly-protected /api/memories endpoints), letting unauthenticated remote attackers read, write, and permanently delete stored memories. GitLab rates it CVSS 9.8 Critical.

Model Context ProtocolPyPICVSS

CVE-2026-50027

AI Security, AppSec· Published and added 5 Jul 2026

github.comrepo🛡️ Security

ThinkWatch

ThinkWatch is a source-available dual-port gateway (Rust/Axum) that proxies both AI provider APIs (OpenAI, Anthropic, Gemini, Azure OpenAI, AWS Bedrock) and MCP tool calls through a single control plane, enforcing authentication, RBAC, rate limits/budgets, and audit logging. Its key differentiator is per-user upstream identity for MCP — propagating each user's own OAuth token/PAT to servers like GitHub/Notion/Slack (AES-256-GCM encrypted, per-key allowlists) instead of a shared service account, plus SSRF-hardened OAuth discovery (RFC 9728/8414/7591), tool-level RBAC, and ClickHouse-backed audit trails forwarded to SIEMs via Syslog/Kafka/webhooks.

Model Context ProtocolOAuthOIDC+3

RFC 9728RFC 8414RFC 7591

AI Security, Identity & Access· Published and added 4 Jul 2026

aikido.devwriteup🛡️ Security

Authentication Bypass in the default configuration phpBB

Aikido Security's technical breakdown of CVE-2026-48611, a critical phpBB authentication bypass in the default configuration: by abusing the OAuth "login-link" feature's auth_provider query parameter, an unauthenticated attacker can force phpBB to use the trust-based `apache` auth provider (meant only for Apache Basic-auth proxies) and log in as any user, including admins, with a single request. The post details the vulnerable code in ucp_login_link.php/apache.php, shows a working PoC (curl/JS), explains a further UCP-to-ACP privilege escalation via the "founder" user's ability to self-promote to admin without a password, and describes an unauthenticated RCE chain via phpBB 4.0's Extensions Catalog fetching malicious extensions from attacker-controlled URLs. It also gives detection guidance (watch for `auth_provider=apache` + `mode=login_link`, including a GET/POST parameter-pollution bypass variant) and a disclosure timeline ending in the patched 3.3.17 release.

phpBBPHPOAuth+2

CVE-2026-48611Santy worm

AppSec, Identity & Access· Added 3 Sep 2026, published 3 Jul 2026

orca.securityarticle🛡️ Security

Orca Security: ITDR for the Cloud

Orca Security explainer defining Identity Threat Detection and Response (ITDR) for cloud environments, distinguishing it from IAM, PAM, EDR, and CIEM as a runtime behavioral-detection layer for identity abuse rather than a preventive/posture control. It covers cloud-specific attack patterns like leaked AWS access-key abuse, AssumeRole/PassRole privilege escalation, OAuth consent phishing, and federation/token abuse, and details how ITDR baselines identity behavior (especially machine/non-human identities) using cloud audit logs like CloudTrail to detect impossible travel and anomalous role assumption, ending with Orca's agentless CIEM+ITDR platform pitch.

AWS IAMMicrosoft Entra IDGoogle Cloud+3

GartnerCrowdStrikekerberoasting+3

Identity & Access, Cloud & Infra, Blue Team & Detection· Published and added 3 Jul 2026

aikido.devarticle🛡️ Security

And another one. GitHub ships break-glass credential revocation

Aikido Security breaks down GitHub's newly shipped self-service credential revocation for Enterprise, which lets org owners bulk-revoke PATs, SSH keys, and OAuth tokens for compromised accounts in one action instead of hunting down individual tokens. The piece ties the feature's timing to a string of 2026 incidents caused by incomplete credential rotation: the Trivy GitHub Actions compromise that force-pushed 75 malicious version tags and cascaded into Checkmarx, and Microsoft's durabletask package/repo being repeatedly compromised via the same never-fully-rotated account (Miasma worm). It also explains why atomic rotation is infeasible at scale and recommends pinning GitHub Actions to commit SHAs instead of tags.

GitHubGitHub ActionsPyPI+2

Miasma wormAzure/durabletaskAqua Security+1

DevSecOps, Supply Chain, Identity & Access· Added 3 Sep 2026, published 1 Jul 2026

huntress.comwriteup🛡️ Security

No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack

Huntress tracked a large, ongoing password spray campaign against Microsoft 365/Azure CLI using the deprecated OAuth ROPC (Resource Owner Password Credentials) flow, which sends passwords directly to the /token endpoint and bypasses MFA prompts enforced via Conditional Access Policies. Between June 12-26, over 81 million login attempts from LSHIY LLC's IPv6 range (AS32167) compromised 78 accounts across 64 organizations, many of which had MFA enabled but scoped incorrectly (app-specific, group-specific, trusted-location exceptions, or report-only mode). After LSHIY terminated the abusive BYOIP customer, attackers pivoted to FranTech (AS53667) and then 3xK Tech GmbH (AS200373), rotating through ~12,800 IPv4 addresses at low per-IP volume to evade detection while sustaining ~1.5 million login attempts/day.

Microsoft 365Azure CLIOAuth+2

LSHIY LLCAS32167AS955+4

Threat Intel, Identity & Access· Added 3 Sep 2026, published 30 Jun 2026

huntress.comarticle🛡️ Security

The Hacker's 2026 Playbook: Dark Web Tactics Targeting You

Huntress details ConsentFix, an evolution of ClickFix that abuses Microsoft 365 OAuth sign-in flows: victims are phished via password-protected Dropbox or DocSend lures, shown a fake Microsoft sign-in page, and tricked into dragging a localhost callback link into their browser, which exfiltrates OAuth tokens and hijacks the session without needing a password or triggering MFA. A cybercrime forum post published the full technique with working code and infrastructure such as Cloudflare Pages, workers.dev, and Pipedream webhooks, and showed attackers using LinkedIn, ZoomInfo, and Hunter.io to profile victims before sending lures.

Microsoft 365OAuthLinkedIn+2

ClickFixConsentFix

Threat Intel, Identity & Access, OSINT· Added 3 Sep 2026, published 29 Jun 2026

Showing 90 of 111