Google device grants lost client and permission binding
A researcher reports USD 13,337 for a device-grant authorization-boundary failure.
USD 13,337reported awardRead
IDVulnerability family
Authentication and identity.
Account lifecycle, session integrity, identity-provider trust. 16 disclosures · 44 related references · 4 diagrams.
Connected collection
Disclosures
Meta service-identity exposure amplified by excessive secret access
A researcher organization reports a $150,000 base award for an exposed service identity with excessive downstream integration authority.
USD 150,000reported awardRead
GitLab recovery delivery lacked verified-address binding
One recovery report received USD 35,000 across two award events.
USD 35,000reported awardRead
LiteSpeed Cache privileged user simulation relied on weak security tokens
Patchstack confirmed a USD 14,400 Zero Day award for an authentication-boundary flaw.
USD 14,400reported awardRead
Meta Quest login migration lost OAuth credential confinement
Meta confirms a USD 44,250 total award, including bonuses, for this Quest OAuth account-access report.
USD 44,250reported awardRead
Meta account verification weakened linked SMS authentication state
Meta confirms a USD 27,200 total award for this account-verification report.
USD 27,200reported awardRead
Pixel lock-screen completion lost security-state binding
A researcher-published vendor decision documents a USD 70,000 award for CVE-2022-20465.
USD 70,000reported awardRead
Microsoft account recovery lacked consistent attempt-limit enforcement
The cited researcher documents a USD 50,000 award for this finding.
USD 50,000reported awardRead
GitHub OAuth consent failed across request-method semantics
A USD 25,000 researcher-reported award illustrates how differing framework and controller assumptions can remove an OAuth consent boundary.
USD 25,000reported awardRead
Instagram recovery challenges were insufficiently bound to accounts
The researcher reports a $10,000 award for this finding. USD is a contextual currency inference from Facebook’s later official retrospective of its 2019 bounty program, not an explicit denomination in the individual…
USD 10,000reported awardRead
Instagram mobile account recovery had inconsistent verification limits
The cited researcher documents a USD 30,000 award for this finding.
USD 30,000reported awardRead
Shopify automatic account conversion lost merchant-consent binding
Shopify confirms a $20,000 award for unauthorized collaborator access caused by automatic account conversion.
USD 20,000reported awardRead
Facebook phone linking lacked account-specific authorization
A 2013 researcher disclosure reports a $20,000 award for unauthorized recovery-phone binding. Its enduring lesson for 2026 applications is that recovery-factor possession and account-change authority require separate…
USD 20,000reported awardRead
Meta Pixel cross-window handling lost message and token authority
The USD 32,500 researcher-reported award illustrates the distinction between message origin and disclosure authority.
USD 32,500reported awardRead
Meta Accounts Center linking lost credential and identity confinement
A researcher-reported USD 30,000 award documents a cross-product account-linking trust failure.
USD 30,000reported awardRead
Facebook SDK message authentication relied on insecure randomness
A USD 66,000 researcher-reported award illustrates how weak message authentication and unsafe rendering can invalidate an SDK trust boundary.
USD 66,000reported awardRead
Connected collection
Related learning
authentik: source-mapping edits carry identity-rebinding authority
CVE-2026-49443 concerns writable identity-mapping fields in API serializers. Delegated connection-management authority could alter which local user or group a source identity represented. The maintainer reports…
Reviewed 2026-10-03Read
Authlib: error responses must preserve redirect-destination validation
CVE-2026-44681 describes an OIDC error path selecting a response destination before client and destination validation. The maintainer reports an unauthorized browser redirect, explicitly excluding direct disclosure of…
Reviewed 2026-10-03Read
AWS IAM security best practices for workload identities
Use this guide to review machine identity design: favor short-lived role credentials for workloads, limit permissions to required actions and resources, and retire unnecessary access. It also explains policy validation,…
Reviewed 2026-10-02Read
Better Auth: single-use authorization requires atomic state consumption
The maintainer disclosure for CVE-2026-53518 identifies separated reading and deletion of a single-use OAuth authorization record. Under concurrent processing, multiple successful consumers could receive independent…
Reviewed 2026-10-03Read
Better Auth: incoming identity proof does not validate existing credentials
CVE-2026-53516 concerns implicit linking to an unverified local account. Provider-side email verification was allowed to confer legitimacy on previously stored local credentials. The resulting merged identity could…
Reviewed 2026-10-03Read
Better Auth SCIM: absent ownership must not grant shared authority
Personal SCIM providers could lack an owner, while management checks rejected mismatched ownership only when an owner existed. Missing identity binding therefore admitted unrelated authenticated users. The maintainer…
Reviewed 2026-10-03Read
Bugsink: time-unit consistency in account-access token expiry
GHSA-4f45-qmjf-82cv describes account-access links whose configured seconds were interpreted as days. The maintainer reports unused email-verification, password-reset and new-user setup tokens surviving their intended…
Reviewed 2026-10-03Read
Chrome bfcache: restored pages and session-state boundaries
Explains Chrome’s conditional admission of no-store pages to the back/forward cache. A restored page resumes in-memory document state rather than performing a fresh network load. The guide describes eviction safeguards…
Reviewed 2026-10-03Read
Dolibarr portal accounts: credential writes need object authorization
Research on CVE-2026-71505 describes inconsistent authorization between reading and modifying company portal accounts. A role-level check did not establish authority over the particular company. In researcher-owned…
Reviewed 2026-10-03Read
Grav API: account-disable enforcement across session authenticators
GHSA-7qfj-82q8-frw6 describes inconsistent account-disable enforcement across authentication methods. Existing browser or remembered sessions could retain API authority because refreshed permissions did not also…
Reviewed 2026-10-04Read
HotCRP: separate submission visibility from authorship authority
GHSA-v8jx-vq6p-jq52 describes an API permission gap between viewing a submission and changing contact authorship. The maintainer reports that reviewers and program-committee members could obtain author-level access to…
Reviewed 2026-10-03Read
Langflow: project transport authorization must reach each resource read
The maintainer confirms that project-level MCP authentication did not authorize later file reads. Resource handlers reached storage without retaining user and project restrictions. A local two-user demonstration showed…
Reviewed 2026-10-03Read
LibreChat: delegated credentials must remain bound to the initiating session
CVE-2026-31944 describes an MCP OAuth callback that trusted cached initiator identity without authenticating the returning browser or checking identity continuity. The advisory describes third-party credentials being…
Reviewed 2026-10-03Read
MCP elicitation: consent, credential custody and completion
Form elicitation excludes secrets. URL elicitation places sensitive interactions outside the MCP client and model context, with the requesting server and destination visible to the user. Agreeing to open the interaction…
Reviewed 2026-10-04Read
MCP scope selection: progressive consent and accumulated authority
Server permission challenges shape what a general-purpose MCP client requests. Broad discovery metadata and accumulated scopes can enlarge delegated authority. Token scopes still require application-side authorization.
Reviewed 2026-10-03Read
n8n Dynamic Credentials: authorize credential lifecycle operations
CVE-2026-54305 concerns authenticated Dynamic Credentials operations missing workflow and credential ownership or scope checks. Maintainers report unauthorized credential metadata access, OAuth identity replacement and…
Reviewed 2026-10-03Read
n8n: directory-attribute authority in durable account linking
CVE-2026-33665 describes local-account linkage that trusted a matching LDAP email attribute. The maintainer reports persistent access to the linked account, including administrator authority, even after the directory…
Reviewed 2026-10-03Read
n8n: refreshed authority must remain bound to the consented resource
The maintainer reports that initial OAuth authorization preserved resource-specific consent, while refresh grants checked registration without preserving that binding. A client could consequently receive authority over…
Reviewed 2026-10-03Read
Cross-device authentication: bind informed consent to session authority
An evaluation of 27 services and a 100-participant user study examines missing context, explicit consent and post-login control in cross-device authentication. Conceptual boundary: an already trusted device may approve…
Reviewed 2026-10-03Read
Nhost: provider adapters must preserve identity-claim evidence
CVE-2026-41574 describes provider adapters converting email presence or fallback profile attributes into a verification claim. An account-linking consumer then treated that normalized claim as ownership evidence. The…
Reviewed 2026-10-03Read
NIST SP 800-162: attribute authority and policy traceability
Defines authorization in terms of subject, object, operation and environmental attributes evaluated against policy. Enterprise considerations connect business rules to machine-enforced decisions, attribute authorities…
Reviewed 2026-10-03Read
OAuth2 Proxy: client-address provenance must precede authentication exemptions
GHSA-wr5q-7wxw-x568 describes client-address metadata acquiring authority to waive authentication without verified transport-peer and intermediary provenance. The maintainer reports unauthenticated access within the…
Reviewed 2026-10-04Read
Obot: preserve delegated token audience and consent boundaries
GHSA-xwmw-prc4-v3cr describes MCP-delegated tokens accepted by broader application APIs because issuer validation did not establish audience authority. Client authorization also lacked explicit consent. The maintainer…
Reviewed 2026-10-03Read
Open WebUI: credentials must bind to their destination connection
CVE-2026-87015 concerns late-bound connection state: tool callables retained their own headers but read a shared cookie variable after connection processing finished. A maintainer-described controlled observation…
Reviewed 2026-10-03Read
Open WebUI: revocation must cross HTTP and realtime boundaries
CVE-2026-59219 documents inconsistent session invalidation: HTTP authentication consulted revocation state, while realtime authentication checked only token signature and expiry. The reported local comparison shows…
Reviewed 2026-10-03Read
Open WebUI: preserve role-policy meaning across identity flows
GHSA-2rr4-q6pg-m5g3 documents a shared-policy input mismatch: browser sign-in supplied identity-token claims, while token exchange supplied only provider user information. Missing role evidence preserved an old role.…
Reviewed 2026-10-03Read
FAPI 2.0 Security Profile
Defines a high-security OAuth profile with coordinated requirements for confidential clients, authorization servers, and resource servers. Connects sender-constrained tokens and authorization-request integrity with the…
Reviewed 2026-10-03Read
Outline: integration authority must end with its owning account
GHSA-33jq-x32c-3ccw describes webhook authority surviving deletion of its creator. Account cleanup omitted webhook subscriptions, while delivery trusted their enabled state. The maintainer-published report describes a…
Reviewed 2026-10-03Read
OWASP Forgot Password
Explains account-bound recovery challenges, limited lifetime and reuse, consistent responses, attempt controls, notifications and post-reset session handling.
Reviewed 2026-10-02Read
Authorization Cheat Sheet
Practical design guidance covering least privilege, deny-by-default behavior, consistent per-request decisions, failure handling, logging, and authorization regression tests.
Reviewed 2026-10-02Read
HTML5 Security Cheat Sheet: Web Messaging
OWASP explains origin checks, expected message formats and treating exchanged content as data. These controls address different assumptions at browser communication boundaries.
Reviewed 2026-10-02Read
OWASP Session Management: privilege-transition integrity
Distinguishes application-issued session identifiers from client-selected values. Explains renewing identifiers at login and other privilege changes, retiring previous identifiers, and separating anonymous tracking from…
Reviewed 2026-10-03Read
pac4j JWT validation: confidentiality does not establish authenticity
Research on CVE-2026-29000 describes an authentication boundary failure: successful decryption could allow claims to become an authenticated profile without mandatory signature validation. The researcher reports…
Reviewed 2026-10-03Read
Prowler SAML: retain validated tenant authority
CVE-2026-59151 concerns token issuance selecting a tenant from an asserted email domain instead of retaining the validated SAML configuration. Maintainers describe potential cross-tenant account takeover. Their…
Reviewed 2026-10-03Read
Pterodactyl: delegated tokens must preserve action-specific authority
GHSA-8r6w-3qq5-4p4r describes an authorization mismatch between the Panel and Wings. Tokens established an authenticated user and server context without adequately separating operation purpose. The maintainer-published…
Reviewed 2026-10-03Read
RFC 10017: OAuth 2.0 for Browser-Based Applications
Compares browser-only OAuth clients, token-mediating backends, and backend-for-frontend architectures through their different token-custody and session boundaries. Separates protection of token material from the…
Reviewed 2026-10-03Read
RFC 9700: Best Current Practice for OAuth 2.0 Security
Consensus guidance updating OAuth's security model with deployment experience, stronger protocol requirements, and deprecated insecure patterns. A primary reference for identity integration reviews.
Reviewed 2026-10-02Read
Rocket.Chat: authentication must await a completed verification decision
CVE-2026-28514 concerned asynchronous password verification in the enterprise account service. The authentication decision treated an unfinished validation object as success instead of using its eventual result. The…
Reviewed 2026-10-03Read
samlify: signing does not establish claim provenance
The maintainer describes inconsistent escaping between XML attribute and element-text contexts during SAML assertion generation. User-controlled profile values could change assertion structure before the identity…
Reviewed 2026-10-03Read
Sentry: resource ownership must match the authorized organization
CVE-2026-26004 concerned a missing organization constraint in event retrieval. A permission check on the active organization did not establish ownership of the requested object. GitHub Security Lab reports…
Reviewed 2026-10-03Read
Universal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in Integration Platforms
Studies account linking across multi-app integration platforms and identifies inconsistent app identity as a trust-boundary problem. Proposes app-specific authorization-context binding.
Reviewed 2026-10-02Read
STEK Sharing is Not Caring: Bypassing TLS Authentication in Web Servers using Session Tickets
Studies a cross-layer authentication failure: shared TLS session-ticket infrastructure can preserve cryptographic session state without preserving the intended virtual-host identity and client-authentication policy. The…
Reviewed 2026-10-03Read
Adversarial passkeys: account recovery must close every continuing source of authority
A qualitative lab study of 31 participants across three services found that unclear passkey labels, notifications and recovery interfaces obstructed complete account remediation. Conceptual boundary: proof that a…
Reviewed 2026-10-03Read
Vercel React Router: session identity must not select unrestricted storage authority
GHSA-7wjf-49rm-77gx describes incoming session identifiers being used as storage keys without validation. Constrained generation did not constrain values returning from the client. The maintainer reports read, overwrite…
Reviewed 2026-10-04Read
Connected collection
Visual models
Recovery must preserve account ownership
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Reviewed 2026-10-02Read
Browser messages need separate trust checks
Original defensive model combining OWASP messaging and authorization guidance with the linked historical cases. These are independent design checks, not a vendor patch diagram or an operational reproduction.
Reviewed 2026-10-02Read
An identity claim must belong to the user
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Reviewed 2026-10-02Read
Keep workload authority tenant-scoped
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Reviewed 2026-10-02Read
Related learning follows the topic crosswalk or an explicit diagram relationship. It does not classify a resource as a finding. Topics overlap, so their counts should not be added together.
GitHub snapshot 2026-10-04
53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software