application-security

3 pieces of writing

Gitea CVE-2026-20896, Auth.js GHSA-7rqj-j65f-68wh and Anritsu CVE-2026-3356 show pre-operation authentication checks failing in 2026

Gitea, Auth.js and Anritsu show the same access-control design failure: trust is established before the operation, then later code consumes authority that was never proven at the point of use.

29 July 2026

security12 min read

Pre-operation access checks failed across 75 trust-boundary incidents analysed in arXiv:2607.01711

15 July 2026

security13 min read

Authentication bypass in 2026: access validation keeps failing before critical operations

18 June 2026