authentication news
7 stories
The MFA Identity Trap: When Authentication Creates a False Sense of Security
A recent report highlights a critical security vulnerability termed the "MFA Identity Trap," where organizations mistakenly equate identity verification, authentication, and threat detection. This conflation reportedly fosters a false sense of security, allowing systems to authenticate malicious actors rather than preventing their access. The report emphasizes the necessity of clearly…
Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access
A new report indicates that malware can exploit Windows Hello for Business keys to maintain persistent access within Microsoft Entra ID environments. This technique allows malicious software operating within an active user session to perform silent authentication using the victim's existing Hello for Business key. The method reportedly bypasses typical biometric or PIN prompts, even on systems…
Critical Gitea Flaw Under Active Exploitation, Researchers Warn
A critical security vulnerability in the popular open-source Git service Gitea is currently being actively exploited by attackers, according to security researchers. The flaw, identified as CVE-2026-20896, allows unauthorized individuals to bypass authentication mechanisms and gain access to sensitive data, including private repositories and secrets.
'GitLost' Flaw Leaks Private Data From GitHub's Agentic Workflows
A newly identified vulnerability, named GitLost, has been discovered that allows for the exfiltration of private data from GitHub's Agentic Workflows. The flaw enables an unauthenticated attacker to exploit a public GitHub Issue to silently steal information from private repositories.
When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website
Researchers have identified a sophisticated phishing campaign that bypasses traditional URL-checking defenses by exploiting a legitimate Microsoft authentication feature. The attack leverages the Microsoft Identity Platform's Device Authorization Grant, a protocol designed for devices with limited input capabilities, such as smart TVs or IoT devices, to authenticate users.
WebAuthn Added to Browser-Based RDP Client
A cybersecurity firm has successfully implemented WebAuthn redirection in its browser-based Remote Desktop Protocol (RDP) client, allowing users to leverage security keys and other FIDO2 authenticators within remote sessions. This development marks the first RDP client outside of Windows to support WebAuthn redirection, preceding Microsoft's own macOS, iOS, and Linux clients, though the…
Protecting Cookies with Device Bound Session Credentials
Google's Chrome browser is introducing a new security feature called Device Bound Session Credentials (DBSC) for Windows users, with support for macOS planned for the near future. This development is designed to significantly enhance protection against session hijacking, a common attack vector where attackers gain unauthorized access to user accounts by stealing session cookies.