Sebastion
←All topics

authorization

3 pieces of writing

security11 min read

Gitea CVE-2026-20896, Auth.js GHSA-7rqj-j65f-68wh and Anritsu CVE-2026-3356 show pre-operation authentication checks failing in 2026

Gitea, Auth.js and Anritsu show the same access-control design failure: trust is established before the operation, then later code consumes authority that was never proven at the point of use.

security12 min read

Pre-operation access checks failed across 75 trust-boundary incidents analysed in arXiv:2607.01711

security13 min read

Authentication bypass in 2026: access validation keeps failing before critical operations