126 records / Open collection
Standards, maintainer advisories, research papers, and practical learning from primary sources.
126 matching records
CVE-2026-88057 concerns sanitization chosen from a directive's compile-time selector rather than the concrete element receiving its host binding. Composition and reuse could therefore apply an absent or weaker policy to…
Angular's advisory for CVE-2026-69149 describes unsafe serialization of untrusted text in fallback raw-content containers. A server-generated DOM can lose its intended inert meaning when later serialization and parsing…
Explains the deployment assumption behind centralized GraphQL federation controls: internal subgraphs accept traffic only through the router. Federation coordination remains available even when ordinary client…
This author-submitted study connects unnecessary cache-key variation with redundant object storage, reduced cache effectiveness and increased origin load. It treats cache-key design as an application availability…
The maintainer describes origin enforcement attached to optional middleware while independently composed dispatchers could invoke application handlers first. The resulting cross-site request forgery can change state…
Astro's base-path removal accepted a textual prefix without establishing a complete path segment. Routing and authorization middleware could consequently disagree about the requested resource. The maintainer bounds the…
CVE-2026-49443 concerns writable identity-mapping fields in API serializers. Delegated connection-management authority could alter which local user or group a source identity represented. The maintainer reports…
CVE-2026-44681 describes an OIDC error path selecting a response destination before client and destination validation. The maintainer reports an unauthorized browser redirect, explicitly excluding direct disclosure of…
Use this guide to review machine identity design: favor short-lived role credentials for workloads, limit permissions to required actions and resources, and retire unnecessary access. It also explains policy validation,…
CVE-2026-68948 documents a transport-contract mismatch: an application configured an outbound body limit, but the HTTP/2 stream path delegated to a transport that did not enforce it. The maintainer-published report…
The maintainer disclosure for CVE-2026-53518 identifies separated reading and deletion of a single-use OAuth authorization record. Under concurrent processing, multiple successful consumers could receive independent…
CVE-2026-53516 concerns implicit linking to an unverified local account. Provider-side email verification was allowed to confer legitimacy on previously stored local credentials. The resulting merged identity could…
Personal SCIM providers could lack an owner, while management checks rejected mismatched ownership only when an owner existed. Missing identity binding therefore admitted unrelated authenticated users. The maintainer…
GHSA-4f45-qmjf-82cv describes account-access links whose configured seconds were interpreted as days. The maintainer reports unused email-verification, password-reset and new-user setup tokens surviving their intended…
Explains Chrome’s conditional admission of no-store pages to the back/forward cache. A restored page resumes in-memory document state rather than performing a fresh network load. The guide describes eviction safeguards…
Explains per-document cross-origin isolation as a response to process-level information exposure that logical origin checks alone cannot prevent. Document Isolation Policy allows independently isolated frames while…
Chrome's design addresses websites using the browser's network position to reach local devices without a separate user decision. A secure-context permission gate reduces local-device CSRF and network fingerprinting. The…
An architecture policy for avoiding the combination of untrusted input, memory-unsafe implementation and high privilege. It explains safer parsing, privilege separation and careful review of unsafe code behind safe…
CVE-2026-55429 concerns a provisioning update-or-insert operation that could change an existing workspace application’s ownership relationship without checking the existing workspace. The maintainer describes potential…
Zafran’s tracing case, CVE-2026-41947, explains that console authentication did not bind configuration changes to the application’s tenant. Traces contain prompts and responses, so changing telemetry routing also…
GHSA-p623-wgx3-wxp8 describes service overrides committing cleanup before their superclass checked permission. Rejected mutations could therefore disconnect automation links, remove attribution metadata or invalidate…
Django confirms CVE-2026-1312: application-controlled column aliases could cross from metadata into SQL structure when used across relation filtering and ordering. Exploitability requires an application to admit…
Research on CVE-2026-71505 describes inconsistent authorization between reading and modifying company portal accounts. A role-level check did not establish authority over the particular company. In researcher-owned…
CVE-2026-49458 describes a mismatch between accepting DOM objects from another realm and recognizing them during later sanitization. Checks tied to local constructor identity could omit protective decisions and subtree…
GHSA-v9w4-gm2x-6rvf describes public file-sharing authority outliving its owner's permissions. Creating a share required sharing and download rights, but subsequent public access did not revalidate those rights. The…
CVE-2026-39351 concerns related-document expansion in a REST response. Frappe loaded linked records without checking the caller’s permission and serialized them without field filtering. The research identifies…
Wiz's CVE-2026-3854 research examines a data-to-authority boundary in GitHub's backend. User-controlled operation metadata reached downstream services as trusted configuration. Code execution was demonstrated on…
Google's approved long-running-operation guidance separates failures before work starts from failures during execution. Its linked Operation contract distinguishes best-effort cancellation, terminal outcomes and…
Google's Approved request-identification guidance makes supplied IDs an idempotency contract with service-defined retention. Duplicates should receive the prior success response; a documented exception permits current…
Google's Approved pagination guidance separates a continuation position from permission to read the collection. Page tokens must be opaque and convey no authorization; each request still requires authorization.…
Google's Approved field-mask guidance defines which resource fields participate in an update. Services must ignore output-only input whether selected directly or through a containing field. Supporting field-behavior…
A GraphQL-Ruby execution-engine path converted a resolver authorization exception into permission to continue. Research demonstrates a denied resolver running and returning a fixture value, while the legacy engine…
GHSA-7qfj-82q8-frw6 describes inconsistent account-disable enforcement across authentication methods. Existing browser or remembered sessions could retain API authority because refreshed permissions did not also…
Official guidance for concise security reports: clear titles, expected versus actual behavior, evidence-backed impact, useful supporting material, scope checks, and remediation suggestions.
GHSA-v8jx-vq6p-jq52 describes an API permission gap between viewing a submission and changing contact authorship. The maintainer reports that reviewers and program-committee members could obtain author-level access to…
The maintainer confirms that project-level MCP authentication did not authorize later file reads. Resource handlers reached storage without retaining user and project restrictions. A local two-user demonstration showed…
The advisory contrasts denied access to a private agent with accepted changes to its attached files. Upload handling omitted the agent permissions enforced elsewhere, allowing unauthorized context and search-file…
CVE-2026-31944 describes an MCP OAuth callback that trusted cached initiator identity without authenticating the returning browser or checking identity continuity. The advisory describes third-party credentials being…
The MCP registry prepared decrypted configuration for internal use, and response handlers returned that representation to viewers without removing secrets. Object visibility consequently became credential disclosure…
The maintainer advisory attributes cross-user knowledge-base file removal to an omitted ownership restriction in a database mutation. Its reported demonstration shows one deletion result. The boundary is between being…
The maintainer advisory for CVE-2026-40871 describes stored configuration being reused unsafely in later database-query construction. Persistence did not make the originally supplied value trustworthy. The source…
Form elicitation excludes secrets. URL elicitation places sensitive interactions outside the MCP client and model context, with the requesting server and destination visible to the user. Agreeing to open the interaction…
Server permission challenges shape what a general-purpose MCP client requests. Broad discovery metadata and accumulated scopes can enlarge delegated authority. Token scopes still require application-side authorization.
Explains recovery after partial completion across services or data stores. Compensation applies domain-specific corrective effects; restoring an earlier snapshot can overwrite valid concurrent changes. Recovery can…
Microsoft Graph documentation distinguishes batch-envelope success from individual outcomes. Its example includes permission denials inside a successful batch response. Member results can arrive in a different order and…
Tachyon’s 2026 account of CVE-2025-14297 describes resource permissions depending on incomplete interface registration. Authentication could succeed while a missing authorization mapping permitted resource access. The…
GHSA-qmh4-5v7g-42jq concerns pending payment state being accepted as authority to grant account credit before provider-confirmed settlement. The account update was atomic, but that concurrency property did not establish…
CVE-2026-54305 concerns authenticated Dynamic Credentials operations missing workflow and credential ownership or scope checks. Maintainers report unauthorized credential metadata access, OAuth identity replacement and…
CVE-2026-33665 describes local-account linkage that trusted a matching LDAP email attribute. The maintainer reports persistent access to the linked account, including administrator authority, even after the directory…
The maintainer reports that initial OAuth authorization preserved resource-specific consent, while refresh grants checked registration without preserving that binding. A client could consequently receive authority over…
An evaluation of 27 services and a 100-participant user study examines missing context, explicit consent and post-login control in cross-device authentication. Conceptual boundary: an already trusted device may approve…
Researchers describe client-supplied metadata becoming authoritative response metadata through unusual middleware header copying. This changed how a dynamic App Router representation was interpreted; an external shared…
Explains how server rendering changes data-access assumptions. A dedicated server-side data layer can centralize authorization and expose only fields required by the interface. Server Actions need their own caller and…
CVE-2026-41574 describes provider adapters converting email presence or fallback profile attributes into a verification claim. An account-linking consumer then treated that normalized claim as ownership evidence. The…
Defines authorization in terms of subject, object, operation and environmental attributes evaluated against policy. Enterprise considerations connect business rules to machine-enforced decisions, attribute authorities…
A foundational model of container images, registries, orchestration, runtimes and host security. It explains shared-kernel risk, workload separation, constrained runtime permissions and lifecycle maintenance.
The maintainer describes request-controlled island data reaching dynamic component selection through attribute inheritance. This permits unintended registered-component or native-element rendering. The boundary fails…
CVE-2026-71316 documents an authorization mismatch between server-rendered HTML and extracted data. A shared path-keyed payload cache omitted requester identity and returned data before current-request guards. The…
GHSA-wr5q-7wxw-x568 describes client-address metadata acquiring authority to waive authentication without verified transport-peer and intermediary provenance. The maintainer reports unauthenticated access within the…
GHSA-xwmw-prc4-v3cr describes MCP-delegated tokens accepted by broader application APIs because issuer validation did not establish audience authority. Client authorization also lacked explicit consent. The maintainer…
CVE-2026-87015 concerns late-bound connection state: tool callables retained their own headers but read a shared cookie variable after connection processing finished. A maintainer-described controlled observation…
CVE-2026-59219 documents inconsistent session invalidation: HTTP authentication consulted revocation state, while realtime authentication checked only token signature and expiry. The reported local comparison shows…
GHSA-2rr4-q6pg-m5g3 documents a shared-policy input mismatch: browser sign-in supplied identity-token claims, while token exchange supplied only provider user information. Missing role evidence preserved an old role.…
CVE-2026-61709 describes incorrect authorization-policy evaluation in user enumeration. Under a particular composition of wildcard membership, exclusion and intersection, a user denied by one policy component could…
Authorization correctness includes the age of relationship state used for a decision. OpenFGA documents a latency-oriented mode that can reuse cached results and a higher-consistency mode that bypasses the cache. With…
Defines a high-security OAuth profile with coordinated requirements for confidential clients, authorization servers, and resource servers. Connects sender-constrained tokens and authorization-request integrity with the…
GHSA-33jq-x32c-3ccw describes webhook authority surviving deletion of its creator. Account cleanup omitted webhook subscriptions, while delivery trusted their enabled state. The maintainer-published report describes a…
Explains account-bound recovery challenges, limited lifetime and reuse, consistent responses, attempt controls, notifications and post-reset session handling.
Versioned requirements for secure development and reviewing web-application security controls. Useful for turning lessons from disclosures into traceable acceptance criteria and regression coverage.
Practical design guidance covering least privilege, deny-by-default behavior, consistent per-request decisions, failure handling, logging, and authorization regression tests.
OWASP explains origin checks, expected message formats and treating exchanged content as data. These controls address different assumptions at browser communication boundaries.
OWASP guidance on centralized handling of unexpected failures, generic client-facing responses and server-side diagnostic records that do not reveal implementation details to clients.
Explains why model-generated content remains untrusted when passed to browsers, databases or backend functions. The relevant boundary is the consuming component: plausible model text must not acquire executable meaning…
Defense-in-depth guidance for LLM applications that consume untrusted content or invoke tools. Covers data provenance, least privilege, action authorization, monitoring, and the limitations of guardrails.
Examines security assumptions around retrieval-augmented generation, including access to embeddings, cross-context disclosure and integrity of imported knowledge. Shared retrieval infrastructure must preserve the…
Explains how whole-codebase reviews and change-focused reviews answer different assurance questions. Connects architecture, business requirements and existing findings to manual examination of data movement, control…
Explains how application events support investigation through consistent context, interaction identifiers, outcomes and confidence information. Distinguishes event occurrence from recording time and treats…
Explains destination validation and network isolation for server-initiated requests, distinguishing fixed trusted destinations from services that need broader external access.
Distinguishes application-issued session identifiers from client-selected values. Explains renewing identifiers at login and other privilege changes, retiring previous identifiers, and separating anonymous tracking from…
Presents an iterative design-review process linking a system model to potential threats, agreed responses and validation. Data-flow diagrams expose trust boundaries and dependencies; structured prompts help identify…
Explains operation-specific approval: show significant transaction details, preserve authorized data, enforce valid state transitions and recheck authorization at execution.
Research on CVE-2026-29000 describes an authentication boundary failure: successful decryption could allow claims to become an authenticated profile without mandatory signature validation. The researcher reports…
GHSA-r899-h629-j84r describes inconsistent interpretation of uploaded-file metadata across admission, storage and browser consumption. The maintainer reports stored cross-site scripting when unsupported filename types…
CVE-2026-59965 describes authenticated plugin endpoints invoking a privileged server interface without preserving collection-level authorization. Payload's Local API skips access checks by default, so a session check…
The maintainer traces duplicate downgrade credits to an eligibility check separated from the later balance change, without transactional isolation. A pending-operation guard did not protect the whole transition. The…
The researcher explains how inconsistent message-boundary interpretation across proxies and origins can break request isolation on shared upstream connections. Client-facing HTTP/2 alone does not remove this risk when…
Free web-security lessons and deliberately designed interactive training environments. Covers authentication, access control, business logic, API security, and other application-security fundamentals.
Explains why a stable database snapshot alone does not preserve business rules across concurrent transactions. PostgreSQL distinguishes serializable consistency from explicit locking and requires serialization-failure…
The API draft distinguishes permission for the top-level and embedded site pair from activated access in a document and cookie eligibility on each request. Secure context, origin, embedding-policy and sandbox conditions…
CVE-2026-59151 concerns token issuance selecting a tenant from an asserted email domain instead of retaining the validated SAML configuration. Maintainers describe potential cross-tenant account takeover. Their…
GHSA-8r6w-3qq5-4p4r describes an authorization mismatch between the Panel and Wings. Tokens established an authenticated user and server context without adequately separating operation purpose. The maintainer-published…
CVE-2026-102999 concerns excessive processing time in the dictionary-based embedded-file interface. The maintainer explains that retrieving each attachment repeatedly parsed the full attachment list. Thus input…
Runtime documentation distinguishes the selected executable, its arguments, and shell interpretation. Python does not implicitly select a shell, but Windows may launch batch files through one. The companion shlex…
The maintainer describes unsafe serialization of virtual-component metadata into server-rendered HTML comments. Application-controlled attributes could cross from serialized state into browser interpretation when user…
The maintainer describes an SSR-to-hydration trust failure: application code that lets untrusted input alter aspects of caught server errors could cause unexpected client constructor execution and outbound network…
Compares browser-only OAuth clients, token-mediating backends, and backend-for-frontend architectures through their different token-custody and session boundaries. Separates protection of token material from the…
Consensus guidance updating OAuth's security model with deployment experience, stronger protocol requirements, and deprecated insecure patterns. A primary reference for identity integration reviews.
CVE-2026-28514 concerned asynchronous password verification in the enterprise account service. The authentication decision treated an unfinished validation object as success instead of using its eventual result. The…
The maintainer describes inconsistent escaping between XML attribute and element-text contexts during SAML assertion generation. User-controlled profile values could change assertion structure before the identity…
CVE-2026-26004 concerned a missing organization constraint in event retrieval. A permission check on the active organization did not establish ownership of the requested object. GitHub Security Lab reports…
The maintainer describes inconsistent escaping across structured-object serialization: some object-derived strings entered generated JavaScript without equivalent protection. Code execution requires attacker-influenced…
Learn to assess software supply-chain assurance using distinct source and build tracks. The build track progresses from recording provenance to authenticated hosted builds and stronger platform isolation. Build…
CVE-2026-94462 concerns a guest-cart ownership transition that required a signed-in customer but omitted the cart-possession check enforced by sibling operations. Account authentication and object lookup were treated as…
CVE-2026-25757 concerns completed guest orders. The access decision treated absence of an account owner as sufficient permission, while lookup did not require the separate order token. GHSL identifies the flaw in tested…
CVE-2026-75523 describes diagnostic URI masking that removed inline credentials but preserved query contents. The failed assumption was that sanitizing one URI component made the whole representation safe for secondary…
Stripe documents duplicate deliveries, unordered events and renewed signatures and timestamps on retries. Signature verification establishes delivery authenticity; it does not establish that the business effect is new…
Research on CVE-2025-15265 explains a data-to-code boundary failure: hydration keys received JavaScript-string serialization without the HTML-context protection already used for values. The researcher demonstrates…
Research on CVE-2025-67647 describes framework-internal routing consuming an origin derived from insufficiently trusted request metadata. The researcher demonstrates server-side response retrieval and process…
CVE-2026-31820 concerns client-supplied component action arguments used to load objects without ownership checks. Property checksums did not cover those arguments. GHSL describes cross-customer address disclosure in…
The advisory distinguishes ownership of an order from authority over its payment operations. Customer-context requests were constrained by ownership but not by operation. A connected payment provider could therefore…
Promotion eligibility used stale in-memory counts, while consumption was persisted later without synchronization. Absolute counter writes could also lose concurrent updates. The failed boundary was between a provisional…
CVE-2026-15305 concerns a lifecycle mismatch between form configuration and upload enforcement. MIME validation was registered before the concrete form properties were available, so the intended validator never entered…
CVE-2026-31834 separates authority over an account from authority to grant its roles. Research on Umbraco CMS 17.2.0 found that group-membership changes checked access to target users but omitted restrictions applied by…
Studies account linking across multi-app integration platforms and identifies inconsistent app identity as a trust-boundary problem. Proposes app-specific authorization-context binding.
Studies a cross-layer authentication failure: shared TLS session-ticket infrastructure can preserve cryptographic session state without preserving the intended virtual-host identity and client-authentication policy. The…
A qualitative lab study of 31 participants across three services found that unclear passkey labels, notifications and recovery interfaces obstructed complete account remediation. Conceptual boundary: proof that a…
Order-level scoping did not carry into globally loaded payment, refund and fulfillment objects. A channel-limited administrator could affect another channel through child-object operations. The advisory contrasts scoped…
GHSA-7wjf-49rm-77gx describes incoming session identifiers being used as storage keys without validation. Constrained generation did not constrain values returning from the client. The maintainer reports read, overwrite…
Vercel’s retrospective describes request-inspection normalization, independent runtime restrictions, regression coverage and customer patching during its React2Shell response. It illustrates why a filter’s…
GHSA-jp29-jrxc-92vf describes a task-search branch that trusted a saved favorite without checking current project access. Favorite records survived share revocation, allowing previously authorized collaborators to keep…
CVE-2026-44826 concerns missing domain constraints between cart quantities and authoritative orders. Arithmetic propagated invalid purchase state through totals and checkout. The maintainer-published report describes a…
Defines a browser-enforced boundary between ordinary strings and typed values accepted by injection-sensitive APIs. The underlying failure is allowing untrusted text to acquire executable interpretation. Policies…
Defines browser-provided request context covering site relationship, destination, mode, and user activation. Explains how redirect history affects that context and why context-dependent responses need matching cache…
Defines browser-feature availability through inherited restrictions, document declarations and frame delegation. Feature defaults govern undeclared cases; a child cannot restore authority disabled by its parent.
Defines how opener policies affect browsing-context separation during navigation. The standard expressly distinguishes severing an opener relationship from a robust boundary between same-origin documents: storage,…
GHSL-2026-049 describes a ticket asset serializer that overrode a permission-aware base implementation without preserving its group-access check. GitHub Security Lab reports confidential ticket and associated-user…
No records match these filters. Try a broader search or reset the collection.
GitHub snapshot 2026-10-04
53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software
| / | Focus search on this page |
| Ctrl K | Search everything (command palette) |
| 1-9 | Library, Generator, Playbooks, Gadgets, Checklists, Payloads, Bypasses, Utilities, Reports |
| 0 | AI / MCP connector |
| j / k | Move selection down / up |
| Enter | Expand / open selected |
| c | Copy primary command of selected |
| f | Toggle favorite on selected tool |
| Esc | Clear search / close |