# This Week in Identity, Issue 10 Source: https://startwithidentity.com/newsletter/2026-08-25-this-week-in-identity-10/ Last updated: 2026-08-29 License: content by Start with Identity. Cite the source URL. --- Issue 10 of This Week in Identity. Three identity providers had flaws this week, and one vendor advisory had a flaw of its own. ## In brief - Microsoft published a CVSS 10.0 Entra ID flaw marked as exploited, then corrected the flag to not-exploited a day later after a journalist asked. - A Keycloak state-validation bug let anyone skip the email verification token and reset any account's password, administrators included. - Mirage2FA reached 4,500 organizations without breaking a single MFA implementation, by taking the session after the login succeeded. ## The big story **Microsoft's CVSS 10.0 Entra ID flaw was fixed service-side, and its advisory was wrong for about 24 hours.** [CVE-2026-69836](https://startwithidentity.com/blog/2026-08-21-microsoft-entra-id-cvss-10-deserialization-flaw/) was unauthenticated deserialization, mitigated inside Microsoft's infrastructure with no customer action required. The advisory shipped with "Exploited: Yes," corrected to "No" the following day. Why it matters: the vulnerability half is genuinely reassuring. Microsoft found it, Microsoft fixed it, and there was nothing to patch. That is the bargain a tenant makes when identity moves to a hosted control plane, and it worked. The disclosure half is harder. For hosted identity there is no customer-side patch to trigger a response, so the advisory field *is* the trigger, which makes its accuracy load-bearing in a way it never was for on-premises software. Teams that stood up an incident bridge on August 20 spent it on a fact that was not true. The practical adjustment: treat a vendor exploitation flag as a prompt to check your own sign-in telemetry, not as a finding, and make sure you can answer "was our tenant affected" from data you hold. ## Patch this week - **[CVE-2026-18963](https://startwithidentity.com/cves/cve-2026-18963/)**, Keycloak (CVSS 9.1). Improper state validation in the reset-credentials flow: a crafted request jumps straight to update-password, no email token needed. Fixed in 26.7.2. [Post](https://startwithidentity.com/blog/2026-08-24-keycloak-reset-credentials-flow-account-takeover/). - **[CVE-2026-19490](https://startwithidentity.com/cves/cve-2026-19490/)**, NetScaler (CVSS 9.3). Authentication bypass on Gateway and AAA virtual servers. Fixed in 14.1-73.32 and 13.1-63.21. [Post](https://startwithidentity.com/blog/2026-08-19-netscaler-gateway-aaa-authentication-bypass/). - **miniOrange SAML plugin**: a loose PHP comparison let attackers sign in as WordPress admin. [Post](https://startwithidentity.com/blog/2026-08-25-miniorange-saml-plugin-signature-bypass-exploited/). ## The pattern Keycloak and, two weeks earlier, Metabase both gave away admin through the password reset endpoint. Account recovery keeps getting built as a support feature and reviewed as one, while functioning as an authentication path with the same privileges as login and usually fewer controls. Every dollar spent on [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) is refunded to the attacker by a reset flow that hands over the password on request. Threat-model recovery like you threat-model login. ## What else happened - **Mirage2FA reached 4,500 organizations** by stealing sessions rather than defeating MFA, the same [attacker-in-the-middle](https://startwithidentity.com/techniques/aitm-phishing-proxy/) shape as Kratos in July. [Post](https://startwithidentity.com/blog/2026-08-25-mirage2fa-session-hijacking-microsoft-365/). - **Three Russian clusters moved from password phishing to OAuth token theft**, using device-code flow, verification-code relay, and fake "Continue with Google" pages. [Post](https://startwithidentity.com/blog/2026-08-21-russian-actors-add-oauth-token-theft-to-targeted-phishing/). - **Operation CameraSwarm compromised 14,530 Dahua devices**, and the ratio is the lesson: password guessing did roughly six times the work of the two CVEs involved. [Post](https://startwithidentity.com/blog/2026-08-19-operation-cameraswarm-dahua-credential-attacks/). - **Poisoned Rust crates** turned routine builds into credential theft in roughly 90-minute windows. [Post](https://startwithidentity.com/blog/2026-08-21-poisoned-rust-crates-steal-developer-credentials/). - **Okta shipped Agent SSO**, making AI agents first-class identities rather than static API keys. [Post](https://startwithidentity.com/blog/2026-08-24-okta-agent-sso-cross-app-access-general-availability/). - **WhatsApp now allows several passkeys per account**, closing the cross-platform gap that pushed users back to SMS. [Post](https://startwithidentity.com/blog/2026-08-25-whatsapp-multiple-passkeys-per-account/). ## New from Start with Identity - **The CVE catalog reached 105 briefs**, with protocol pages and cross-links into breaches and techniques. ## From the community We are still recruiting [volunteers](https://startwithidentity.com/community/#volunteer): news curators, country ambassadors, and jobs scouts. A few hours a week, credited by name. That's Issue 10. [Subscribe](https://startwithidentity.com/subscribe/) for the next one.