Sebastion
←All topics

architecture

5 pieces of writing

security11 min read

Gitea CVE-2026-20896, Auth.js GHSA-7rqj-j65f-68wh and Anritsu CVE-2026-3356 show pre-operation authentication checks failing in 2026

Gitea, Auth.js and Anritsu show the same access-control design failure: trust is established before the operation, then later code consumes authority that was never proven at the point of use.

security12 min read

Pre-operation access checks failed across 75 trust-boundary incidents analysed in arXiv:2607.01711

security13 min read

OpenClaw's 470 advisories show unauthenticated RCE became a cloud AI platform pattern

security13 min read

Authentication bypass in 2026: access validation keeps failing before critical operations

Authentication bypass keeps recurring because modern applications validate identity at convenient edges, then perform critical operations in layers that no longer know whether access was proven.

security13 min read

CIFSwitch CVE-2026-46243 and PraisonAI show privilege escalation is an architectural antipattern