// #authentication
8 articles
GNU SASL CVE-2026-48829: DIGEST-MD5 Parser Crash Affects Enterprise Mail Servers and LDAP Stacks
A NULL pointer dereference in GNU SASL's DIGEST-MD5 authentication mechanism (CVE-2026-48829, CVSS 7.5) allows a remote attacker to crash any service using GNU SASL for DIGEST-MD5 authentication by sending a malformed authentication token. Debian and other distribution security advisories published 24 May. Services affected include Postfix, Cyrus IMAP, and LDAP servers using SASL for authentication.
SASL Authentication Security in Enterprise Mail Servers: Deprecating DIGEST-MD5 and Hardening SMTP AUTH
The GNU SASL CVE-2026-48829 DIGEST-MD5 crash is a reminder that legacy authentication mechanisms in enterprise mail infrastructure carry risk that is often invisible to security teams. A structured review of SASL mechanism configuration in Postfix, Dovecot, and Exchange environments can eliminate entire vulnerability classes while improving authentication security.
Pwn2Own Week Exposes the Limits of Identity as a Security Control — What IAM Teams Should Review
The week of 12–18 May 2026 produced two distinct scenarios where identity controls — Conditional Access, MFA, and Zero Trust enforcement — provided no meaningful protection: Exchange Server-side RCE (operating below the authentication layer) and Exchange OWA session hijacking (stealing tokens after authentication). Both are active or imminent threats. Both require defences that go beyond the identity layer.
Why Exchange SYSTEM RCE Bypasses Conditional Access and MFA: The Authentication Architecture Problem
The Exchange SYSTEM RCE chain demonstrated by DEVCORE at Pwn2Own Berlin 2026 achieves code execution at the operating system level, bypassing all identity controls including Conditional Access policies, MFA requirements, and Azure AD authentication entirely. Understanding why server-side RCE renders identity controls irrelevant is essential for accurate risk assessment.
Fortinet Patches Critical Vulnerabilities in FortiAuthenticator and FortiSandbox — Enterprise SSO and Security Infrastructure at Risk
Fortinet released patches for critical vulnerabilities in FortiAuthenticator and FortiSandbox as part of the May 2026 patch cycle. FortiAuthenticator flaws can enable authentication bypass and session manipulation in enterprise SSO deployments, while FortiSandbox issues affect the analysis platform. Apply patches immediately given Fortinet's established exploitation history.
Citrix NetScaler CVE-2026-3055 Actively Exploited — CISA Orders Patch by 2 April
A critical unauthenticated memory overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway is being actively exploited in the wild, with CISA adding it to the Known Exploited Vulnerabilities catalogue. Appliances configured as SAML Identity Providers are leaking sensitive memory contents including session tokens via a crafted SAML request.
April Windows Update Enforces AES-Only Kerberos — RC4 Fallback Blocked Across Active Directory
Microsoft's April 2026 cumulative update moves Windows domain controllers into AES-only Kerberos enforcement mode, permanently blocking RC4-HMAC as an authentication fallback under CVE-2026-20833. Organisations with legacy service accounts or unmanaged devices that have not set the msDS-SupportedEncryptionTypes attribute will begin seeing Kerberos authentication failures when the update is deployed.
Windows Kerberos Security Feature Bypass CVE-2026-24297 — Race Condition Enables Unauthenticated Network Attack
CVE-2026-24297 is a security feature bypass in the Windows Kerberos implementation caused by a race condition that can be triggered remotely without credentials or user interaction. Patched in the March 2026 Patch Tuesday, the vulnerability allows an attacker with network access to a Kerberos-speaking service to bypass security validation in the authentication flow. No active exploitation has been confirmed but the attack vector requires no credentials, increasing urgency.
Commentary tagged #authentication
TOTP MFA Is Security Theatre and We Need to Admit It
Adversary-in-the-Middle toolkits that defeat time-based one-time passwords are commercially available for under £400. The security industry's continued recommendation of TOTP as meaningful phishing protection is not a minor technical nuance — it is a significant misrepresentation of what MFA actually protects against in 2026.
CipherWatch Editorial
Security Intelligence Platform
Active Directory Keeps Getting Owned Because We Keep Letting It
A Kerberos authentication bypass and an Active Directory privilege escalation were both patched this week, adding to a multi-year catalogue of critical flaws in Microsoft's foundational identity infrastructure. The problem is not that Microsoft keeps shipping vulnerabilities — it is that organisations keep deploying Active Directory in configurations that maximise their exposure when those vulnerabilities arrive.
CipherWatch Editorial
Security Intelligence Platform