This Week in Identity, Issue 10

Issue 10 of This Week in Identity. Three identity providers had flaws this week, and one vendor advisory had a flaw of its own.

In brief

Microsoft published a CVSS 10.0 Entra ID flaw marked as exploited, then corrected the flag to not-exploited a day later after a journalist asked.
A Keycloak state-validation bug let anyone skip the email verification token and reset any account's password, administrators included.
Mirage2FA reached 4,500 organizations without breaking a single MFA implementation, by taking the session after the login succeeded.

The big story

Microsoft's CVSS 10.0 Entra ID flaw was fixed service-side, and its advisory was wrong for about 24 hours. CVE-2026-69836 was unauthenticated deserialization, mitigated inside Microsoft's infrastructure with no customer action required. The advisory shipped with "Exploited: Yes," corrected to "No" the following day.

Why it matters: the vulnerability half is genuinely reassuring. Microsoft found it, Microsoft fixed it, and there was nothing to patch. That is the bargain a tenant makes when identity moves to a hosted control plane, and it worked.

The disclosure half is harder. For hosted identity there is no customer-side patch to trigger a response, so the advisory field is the trigger, which makes its accuracy load-bearing in a way it never was for on-premises software. Teams that stood up an incident bridge on August 20 spent it on a fact that was not true. The practical adjustment: treat a vendor exploitation flag as a prompt to check your own sign-in telemetry, not as a finding, and make sure you can answer "was our tenant affected" from data you hold.

Patch this week

CVE-2026-18963, Keycloak (CVSS 9.1). Improper state validation in the reset-credentials flow: a crafted request jumps straight to update-password, no email token needed. Fixed in 26.7.2. Post.
CVE-2026-19490, NetScaler (CVSS 9.3). Authentication bypass on Gateway and AAA virtual servers. Fixed in 14.1-73.32 and 13.1-63.21. Post.
miniOrange SAML plugin: a loose PHP comparison let attackers sign in as WordPress admin. Post.

The pattern

Keycloak and, two weeks earlier, Metabase both gave away admin through the password reset endpoint. Account recovery keeps getting built as a support feature and reviewed as one, while functioning as an authentication path with the same privileges as login and usually fewer controls. Every dollar spent on phishing-resistant MFA is refunded to the attacker by a reset flow that hands over the password on request. Threat-model recovery like you threat-model login.

What else happened

Mirage2FA reached 4,500 organizations by stealing sessions rather than defeating MFA, the same attacker-in-the-middle shape as Kratos in July. Post.
Three Russian clusters moved from password phishing to OAuth token theft, using device-code flow, verification-code relay, and fake "Continue with Google" pages. Post.
Operation CameraSwarm compromised 14,530 Dahua devices, and the ratio is the lesson: password guessing did roughly six times the work of the two CVEs involved. Post.
Poisoned Rust crates turned routine builds into credential theft in roughly 90-minute windows. Post.
Okta shipped Agent SSO, making AI agents first-class identities rather than static API keys. Post.
WhatsApp now allows several passkeys per account, closing the cross-platform gap that pushed users back to SMS. Post.

New from Start with Identity

The CVE catalog reached 105 briefs, with protocol pages and cross-links into breaches and techniques.

From the community

We are still recruiting volunteers: news curators, country ambassadors, and jobs scouts. A few hours a week, credited by name.

That's Issue 10. Subscribe for the next one.