Tag: authentication
-
MFA Prompt Bombing: Why Your Second Factor Isn’t Saving You
Multi-factor authentication (MFA) was supposed to close a critical gap in identity security. It meant that, even if an attacker possessed the account credentials, they couldn’t log in without the second factor. While that logic was sound, attackers have now figured out that they don’t need to steal the second factor: they just need the…
-
MFA Prompt Bombing: Why Your Second Factor Isn’t Saving You
Multi-factor authentication (MFA) was supposed to close a critical gap in identity security. It meant that, even if an attacker possessed the account credentials, they couldn’t log in without the second factor. While that logic was sound, attackers have now figured out that they don’t need to steal the second factor: they just need the…
-
Memcached SASL Flaw Exposes Usernames to Enumeration Attacks
A newly identified vulnerability in Memcached has raised concerns among security professionals after researchers confirmed a timing side-channel flaw that allows attackers to enumerate valid usernames. Tracked as CVE-2026-47783, the issue affects Memcached versions before 1.6.42 and specifically impacts SASL (Simple Authentication and Security Layer) password database authentication. The flaw stems from improper username validation…
-
Ghost CMS Vulnerability Exploited to Infect 700 Sites With ClickFix Malware
Hackers are actively exploiting a critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980) to compromise websites and distribute ClickFix malware through large-scale page-poisoning attacks. The vulnerability allows attackers to extract sensitive database contents without authentication, including the Ghost Admin API Key. Unlike the read-only Content API Key, this administrative key grants full control over posts…
-
FBI warns of Kali365 phishing service targeting Microsoft 365 accounts
The FBI is warning about the Kali365 phishing-as-a-service platform (PhaaS) that is used to hijack Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and bypass multi-factor authentication (MFA). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fbi-warns-of-kali365-phishing-service-targeting-microsoft-365-accounts/
-
npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks
GitHub has rolled out new controls for npm to improve the security of the software supply chain, giving maintainers the ability to explicitly approve a release prior to the packages becoming publicly available for installation.Called staged publishing, the feature is now generally available on npm. It mandates that a human maintainer pass a two-factor authentication…
-
RondoDox Botnet Exploits Critical 2018 Vulnerability to Hijack ASUS Routers
Cybersecurity firm VulnCheck reveals hackers are using a critical 2018 vulnerability to bypass authentication and hack over a million ASUS routers. First seen on hackread.com Jump to article: hackread.com/rondodox-botnet-2018-vulnerability-hijack-asus-routers/
-
RondoDox Botnet Exploits Critical 2018 Vulnerability to Hijack ASUS Routers
Cybersecurity firm VulnCheck reveals hackers are using a critical 2018 vulnerability to bypass authentication and hack over a million ASUS routers. First seen on hackread.com Jump to article: hackread.com/rondodox-botnet-2018-vulnerability-hijack-asus-routers/
-
Microsoft to phase out SMS authentication for account recovery
First seen on scworld.com Jump to article: www.scworld.com/brief/microsoft-to-phase-out-sms-authentication-for-account-recovery
-
Fake Gemini and Claude Code Sites Spread Infostealers Through SEO Poisoning
The infostealer payload in this campaign collect a vast amount of data, from collaboration authentication keys to cryptocurrency wallets First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/gemini-claude-infostealers-seo/
-
FBI Warns Kali365 PhaaS Platform Targets Microsoft 365 Users to Steal Logins
The U.S. Federal Bureau of Investigation (FBI) has issued a Public Service Announcement (Alert I-052126-PSA) warning about a newly identified Phishing-as-a-Service (PhaaS) platform named Kali365, which is actively targeting Microsoft 365 users. First observed in April 2026, the platform enables attackers to bypass multi-factor authentication (MFA) by exploiting OAuth-based authentication flows. Kali365 PhaaS Platform Targets Microsoft…
-
Mini Shai-Hulud Attack Prompts npm to Revoke 2FA-Bypass Tokens
npm has forced a platform-wide reset of granular access tokens that bypass two-factor authentication (2FA) after a wave of supply chain attacks linked to the “Mini Shai-Hulud” campaign compromised hundreds of JavaScript packages. The emergency action, rolled out on May 19, invalidated all npm tokens with write permissions that allowed publishing without 2FA. The move…
-
Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access
Cisco has rolled out updates for a maximum-severity security flaw impacting Secure Workload that could allow an unauthenticated, remote attacker to access sensitive data.Tracked as CVE-2026-20223 (CVSS score: 10.0), the vulnerability arises from insufficient validation and authentication when accessing REST API endpoints.”An attacker could exploit this vulnerability if they are able to send First seen…
-
Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access
Cisco has rolled out updates for a maximum-severity security flaw impacting Secure Workload that could allow an unauthenticated, remote attacker to access sensitive data.Tracked as CVE-2026-20223 (CVSS score: 10.0), the vulnerability arises from insufficient validation and authentication when accessing REST API endpoints.”An attacker could exploit this vulnerability if they are able to send First seen…
-
Cisco fixed maximum severity flaw CVE-2026-20223 in Secure Workload
Cisco fixed a critical Secure Workload flaw (CVE-2026-20223) that could let attackers gain Site Admin privileges through crafted API requests. Cisco released patches for a critical vulnerability, tracked as CVE-2026-20223 (CVSS score of 10.0), in Secure Workload. The flaw stems from insufficient validation and authentication in REST API endpoints. According to Cisco, remote attackers could…
-
Apache OFBiz RCE Flaw Abuses Password-Change Restrictions for Authentication Bypass
Tags: apache, authentication, business, cyber, flaw, open-source, password, rce, remote-code-execution, vulnerabilityA critical authentication bypass vulnerability in Apache OFBiz allows attackers to hijack forced password-change flows and achieve remote code execution (RCE) via a single HTTP request, affecting all versions before 24.09.06. Apache OFBiz RCE Flaw Apache OFBiz is an open-source Enterprise Resource Planning (ERP) platform used for managing business processes. When an administrator flags a…
-
Critical Vulnerability in Cisco Secure Workload Threatens Enterprise API Security
Cisco has disclosed a critical security vulnerability in its Secure Workload platform that could allow unauthenticated attackers to gain high-level administrative access to sensitive enterprise environments. The flaw, tracked as CVE-2026-20223, carries a maximum CVSS score of 10.0 and is classified under CWE-306 (Missing Authentication for Critical Function). According to Cisco’s advisory (cisco-sa-csw-pnbsa-g8WEnuy), the issue…
-
Pardus Linux Vulnerability Chain Enables Complete System Takeover
A critical local privilege escalation vulnerability chain tracked as CVE-20265140 has exposed serious security weaknesses in Pardus Linux. Researchers revealed that the flaws allow any unprivileged local user to gain full root access without authentication, potentially leading to complete system compromise within seconds. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cve-2026-5140-pardus-linux-root-access-flaw/
-
Hackers bypass SonicWall VPN MFA due to incomplete patching
Threat actors brute-forced VPN credentials and bypassed multi-factor authentication (MFA) on SonicWall Gen6 SSL-VPN appliances to deploy tools used in ransomware attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-bypass-sonicwall-vpn-mfa-due-to-incomplete-patching/
-
EClient Thunderbird 151 – Update verbessert OAuth-Authentifizierung
Thunderbird 151 erweitert unter anderem die OAuth-Anmeldung um zusätzliche Funktionen und schließt Sicherheitslücken. First seen on computerbase.de Jump to article: www.computerbase.de/news/apps/e-mail-client-thunderbird-151-update-verbessert-oauth-authentifizierung.97439
-
Die DSGVO im KI-Zeitalter: Wenn Maßnahmen nicht mehr zur Realität passen
Executive Summary TOM-Dokumentationen (Art.”¯32 DSGVO) sind veraltet, weil sie zwischen 20182022 entstanden und nicht auf autonome KI”‘Agenten, Prompt”‘Injection”‘Risiken oder dynamische Modelle ausgelegt sind. Art.”¯32 basiert auf einem Akteursmodell, das nicht mehr existiert: DSGVO setzt vorhersehbare, zweckgebundene menschliche oder systemische Akteure voraus KI”‘Agenten brechen diese Logik. Drei neue technische Anforderungen werden notwendig: Authentifizierung gegen den… First…
-
OverDoS in n8n Wie eine OAuth-Funktion über 70.000 Automatisierungsserver lahmlegen kann
Die Open-Source-Automatisierungsplattform n8n steht erneut im Fokus der Sicherheitsforschung. Diesmal geht es nicht um klassischen Remote Code Execution, sondern um eine besonders perfide Denial-of-Service-Schwachstelle mit dem Namen OverDoS. Sicherheitsforscher von Checkmarx zeigen, wie Angreifer ohne Authentifizierung ganze n8n-Instanzen gezielt mit Daten fluten und dadurch unbrauchbar machen können. Betroffen sind potenziell zehntausende öffentlich erreichbare Systeme. CVE-2026-42236:…
-
Four-Faith Industrial Routers Targeted in Botnet Hijacking Campaign
Tags: authentication, botnet, cve, cyber, data-breach, exploit, flaw, malicious, router, vulnerabilityFour-Faith industrial cellular routers are being actively targeted in a growing botnet campaign exploiting a critical authentication bypass flaw tracked as CVE-2024-9643. Security researchers warn that attackers are rapidly weaponizing the vulnerability to hijack exposed devices and repurpose them as part of large-scale malicious infrastructure. Four-Faith Industrial Routers Targeted CVE-2024-9643 affects Four-Faith F3x36 industrial routers…
-
Earbud sensors can authenticate users by their heartbeat, study finds
Tags: authenticationResearchers built a continuous authentication system called AccLock that identifies a wearer by the tiny vibrations a heartbeat makes inside the ear canal. The signal comes … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/19/earbud-heartbeat-authentication-research/
-
CVE-2026-20182: Unauthenticated Cisco SD-WAN Control-Plane Compromise via vHub Authentication Bypass
First seen on resecurity.com Jump to article: www.resecurity.com/blog/article/cve-2026-20182-unauthenticated-cisco-sd-wan-control-plane-compromise-via-vhub-authentication-bypass
-
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws
Tags: authentication, control, cvss, exploit, flaw, fortinet, injection, ivanti, rce, remote-code-execution, sap, sql, update, vmware, vulnerabilityIvanti, Fortinet, n8n, SAP, and VMware have released security fixes for various vulnerabilities that could be exploited by bad actors to bypass authentication and execute arbitrary code.Topping the list is a critical flaw impacting Ivanti Xtraction (CVE-2026-8043, CVSS score: 9.6) that could be exploited to achieve information disclosure or client-side attacks.”External control of a file…
-
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws
Tags: authentication, control, cvss, exploit, flaw, fortinet, injection, ivanti, rce, remote-code-execution, sap, sql, update, vmware, vulnerabilityIvanti, Fortinet, n8n, SAP, and VMware have released security fixes for various vulnerabilities that could be exploited by bad actors to bypass authentication and execute arbitrary code.Topping the list is a critical flaw impacting Ivanti Xtraction (CVE-2026-8043, CVSS score: 9.6) that could be exploited to achieve information disclosure or client-side attacks.”External control of a file…
-
New Cisco SD-WAN Zero-Day Grants Admin Access
Broken vdaemon Peering Authentication Enables Unauthenticated Admin Access. A maximum-severity vulnerability in Cisco Catalyst SD-WAN Controller is being actively exploited, giving attackers administrative privileges without authentication. The authentication bypass vulnerability stems from a broken peering authentication mechanism. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/new-cisco-sd-wan-zero-day-grants-admin-access-a-31708