Tag: authentication
-
What are Auth Tokens? Complete Guide to Token-Based Authentication Implementation
Learn about auth tokens, token-based authentication, JWTs, and implementation strategies. Enhance security and user experience in enterprise SSO and CIAM. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/what-are-auth-tokens-complete-guide-to-token-based-authentication-implementation/
-
Unpatched FortiGate Security Flaw Allows Attackers to Bypass 2FA Controls
A critical authentication bypass vulnerability in FortiGate devices enables threat actors to circumvent two-factor authentication (2FA) protections through case-sensitive username manipulation. The flaw, tracked as CVE-2020-12812, affects organizations with specific LDAP integration configurations and remains exploitable on unpatched systems. The vulnerability stems from FortiGate’s default case-sensitive username handling conflicting with LDAP directories that treat usernames…
-
Fortinet Warns of Active Exploitation of FortiOS SSL VPN 2FA Bypass Vulnerability
Fortinet on Wednesday said it observed “recent abuse” of a five-year-old security flaw in FortiOS SSL VPN in the wild under certain configurations.The vulnerability in question is CVE-2020-12812 (CVSS score: 5.2), an improper authentication vulnerability in SSL VPN in FortiOS that could allow a user to log in successfully without being prompted for the second…
-
CISA Flags Actively Exploited Digiever NVR Vulnerability Allowing Remote Code Execution
Tags: authentication, cisa, cve, cybersecurity, exploit, flaw, infrastructure, injection, kev, network, remote-code-execution, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a security flaw impacting Digiever DS-2105 Pro network video recorders (NVRs) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability, tracked as CVE-2023-52163 (CVSS score: 8.8), relates to a case of command injection that allows post-authentication remote code First seen on thehackernews.com…
-
Why Mobile-First SaaS Needs Passwordless Authentication for Field Teams
Learn why passwordless authentication is essential for mobile-first SaaS used by field teams to improve security, speed, and productivity. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/why-mobile-first-saas-needs-passwordless-authentication-for-field-teams/
-
Operation PCPcat Exploits Next.js and React, Impacting 59,000+ Servers
Tags: access, authentication, control, credentials, cyber, data, exploit, framework, infrastructure, monitoring, vulnerabilityA sophisticated credential-stealing campaign named >>Operation PCPcat
-
ServiceNow’s $7.75 billion cash deal for Armis illustrates shifting strategies
Tags: access, ai, attack, authentication, automation, business, ceo, cio, ciso, computing, control, cyber, governance, identity, incident response, intelligence, iot, risk, service, strategy, tool, update, vulnerabilityVisibility is the key: “For decades, the CIO’s white whale has been a precise, real-time Configuration Management Database [CMDB]. Most are outdated the moment they are populated,” said Whisper Security CEO Kaveh Ranjbar. The Armis acquisition “is an admission that in an era of IoT, OT, and edge computing, you cannot rely on manual entry…
-
Building Secure User Portals for Content-Heavy SaaS Applications
Learn how to build secure user portals for content-heavy SaaS using passwordless authentication, RBAC, session security, and CDN protection. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/building-secure-user-portals-for-content-heavy-saas-applications/
-
Malicious NPM Package Hits 56K Downloads, Steals WhatsApp Messages
A sophisticated malware campaign has compromised the npm registry through a malicious package that perfectly mimics legitimate WhatsApp API functionality while silently exfiltrating authentication credentials, messages, contacts, and media files from unsuspecting developers. The lotusbail package, addressed over 56,000 times during its six-month presence on npm, represents a dangerous evolution in supply chain attacks where…
-
Agentic AI already hinting at cybersecurity’s pending identity crisis
Agentic AI’s identity crisis: Authentication and agentic experts interviewed, three of whom estimate that less than 5% of enterprises experimenting with autonomous agents have deployed agentic identity systems, say the reasons for this lack of security hardening are varied.First, many of these efforts are effectively shadow IT, where a line of business (LOB) executive has…
-
10 Best Multi-Factor Authentication Solutions in 2026
Explore the 10 best MFA solutions in 2026. Compare features, pricing, pros, cons, and find the right multi-factor authentication tool for your business. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/10-best-multi-factor-authentication-solutions-in-2026/
-
15 Best Passwordless Authentication Solutions in 2026
Tags: authenticationCompare the 15 best passwordless authentication solutions for 2026. Explore features, pricing, use cases, and how to choose the right tool. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/15-best-passwordless-authentication-solutions-in-2026/
-
9 MFA Mistakes in Manufacturing IT and Fixes
Discover the most common MFA mistakes in manufacturing IT and learn practical fixes to improve security, uptime, and authentication on factory floors. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/9-mfa-mistakes-in-manufacturing-it-and-fixes/
-
Handwritten Passwords for Touchscreen Devices
Explore handwritten passwords for touchscreen devices: a unique authentication method. Learn about security, usability, implementation, and how it compares to traditional passwords. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/handwritten-passwords-for-touchscreen-devices/
-
Authentication Platform Comparison: Best Authentication Systems Tools for Your Business
Compare leading authentication platforms like Okta, Auth0, and open-source tools. Find the best authentication system for your business needs, balancing security, cost, and scalability. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/authentication-platform-comparison-best-authentication-systems-tools-for-your-business/
-
25,000+ FortiCloud SSO-Enabled Systems Vulnerable to Remote Exploitation
The Shadowserver Foundation has identified over 25,000 internet-facing Fortinet devices globally with FortiCloud Single Sign-On (SSO) functionality enabled, raising concerns about potential exposure to critical authentication bypass vulnerabilities. The non-profit security organization recently added fingerprinting capabilities for these systems to its Device Identification reporting service, alerting network administrators to verify their security posture immediately. Mass…
-
25,000+ FortiCloud SSO-Enabled Systems Vulnerable to Remote Exploitation
The Shadowserver Foundation has identified over 25,000 internet-facing Fortinet devices globally with FortiCloud Single Sign-On (SSO) functionality enabled, raising concerns about potential exposure to critical authentication bypass vulnerabilities. The non-profit security organization recently added fingerprinting capabilities for these systems to its Device Identification reporting service, alerting network administrators to verify their security posture immediately. Mass…
-
Russia-Linked Hackers Use Microsoft 365 Device Code Phishing for Account Takeovers
Tags: attack, authentication, credentials, email, government, group, hacker, microsoft, phishing, russiaA suspected Russia-aligned group has been attributed to a phishing campaign that employs device code authentication workflows to steal victims’ Microsoft 365 credentials and conduct account takeover attacks.The activity, ongoing since September 2025, is being tracked by Proofpoint under the moniker UNK_AcademicFlare.The attacks involve using compromised email addresses belonging to government First seen on thehackernews.com…
-
Over 25,000 FortiCloud SSO devices exposed to remote attacks
Internet security watchdog Shadowserver has found over 25,000 Fortinet devices exposed online with FortiCloud SSO enabled, amid ongoing attacks targeting a critical authentication bypass vulnerability. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/over-25-000-forticloud-sso-devices-exposed-to-remote-attacks/
-
Attackers bring their own passwords to Cisco and Palo Alto VPNs
Tags: authentication, cisco, credentials, data-breach, endpoint, infrastructure, login, malicious, mfa, password, threat, vpnBrute-forcing Cisco’s SSL VPN follows: Just a day after the GlobalProtect surge, the same actor infrastructure pivoted to Cisco’s SSL VPN endpoints, with the same TCP fingerprint and hosting provider IP space. GreyNoise saw the number of unique attacking IPs jump from a typical daily baseline of fewer than 200 to over 1200, signalling a…
-
Attackers bring their own passwords to Cisco and Palo Alto VPNs
Tags: authentication, cisco, credentials, data-breach, endpoint, infrastructure, login, malicious, mfa, password, threat, vpnBrute-forcing Cisco’s SSL VPN follows: Just a day after the GlobalProtect surge, the same actor infrastructure pivoted to Cisco’s SSL VPN endpoints, with the same TCP fingerprint and hosting provider IP space. GreyNoise saw the number of unique attacking IPs jump from a typical daily baseline of fewer than 200 to over 1200, signalling a…
-
Attackers bring their own passwords to Cisco and Palo Alto VPNs
Tags: authentication, cisco, credentials, data-breach, endpoint, infrastructure, login, malicious, mfa, password, threat, vpnBrute-forcing Cisco’s SSL VPN follows: Just a day after the GlobalProtect surge, the same actor infrastructure pivoted to Cisco’s SSL VPN endpoints, with the same TCP fingerprint and hosting provider IP space. GreyNoise saw the number of unique attacking IPs jump from a typical daily baseline of fewer than 200 to over 1200, signalling a…
-
Exploring Biometric Multi-Factor Authentication
Explore biometric mfa for enhanced security. Learn about implementation, benefits, hacking techniques, and how to protect your systems. A must-read for developers. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/exploring-biometric-multi-factor-authentication/
-
Exploring Biometric Multi-Factor Authentication
Explore biometric mfa for enhanced security. Learn about implementation, benefits, hacking techniques, and how to protect your systems. A must-read for developers. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/exploring-biometric-multi-factor-authentication/
-
Exploring Biometric Multi-Factor Authentication
Explore biometric mfa for enhanced security. Learn about implementation, benefits, hacking techniques, and how to protect your systems. A must-read for developers. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/exploring-biometric-multi-factor-authentication/
-
Client ID Metadata Documents (CIMD): The Future of MCP Authentication
Struggling with MCP authentication? The November 2025 spec just changed everything. CIMD replaces DCR’s complexity with a simple URL-based approach”, no registration endpoints, no client ID sprawl, built-in identity verification. Here’s your complete implementation guide with production code. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/client-id-metadata-documents-cimd-the-future-of-mcp-authentication/