Sebastion
←All topics

authentication

7 pieces of writing

security11 min read

Gitea CVE-2026-20896, Auth.js GHSA-7rqj-j65f-68wh and Anritsu CVE-2026-3356 show pre-operation authentication checks failing in 2026

Gitea, Auth.js and Anritsu show the same access-control design failure: trust is established before the operation, then later code consumes authority that was never proven at the point of use.

security12 min read

Pre-operation access checks failed across 75 trust-boundary incidents analysed in arXiv:2607.01711

security13 min read

Authentication bypass in 2026: access validation keeps failing before critical operations

security12 min read

Gogs, PraisonAI and KnowledgeDeliver show authentication bypass is a self-hosted platform design failure

Gogs, PraisonAI and KnowledgeDeliver show why authentication bypass in self-hosted platforms is often an architectural failure, not a missing if statement.

AReaL PR #1323 refuses the default admin API key on network-facing proxy binds
vulnerability9 min read

AReaL PR #1323 refuses the default admin API key on network-facing proxy binds

Seven authentication bypasses that keep shipping in 2025 and 2026: the same architectural antipatterns, rewritten in new frameworks
security11 min read

Seven authentication bypasses that keep shipping in 2025 and 2026: the same architectural antipatterns, rewritten in new frameworks

Every MCPHub instance started with the same admin password. I changed that.
vulnerability7 min read

Every MCPHub instance started with the same admin password. I changed that.

MCPHub shipped every installation with the hardcoded credential admin/admin123 and published it in the README. The fix generates a cryptographically random password per instance.