This Week in Identity, Issue 12
Issue 12 of This Week in Identity. A quieter week by volume, and a significant one by substance: the first phishing kit we have seen that treats a phishing-resistant credential as something to route around.
In brief
- BigBear 2.0 injects JavaScript that disables FIDO2 and WebAuthn in the victim's browser, so the sign-in falls back to a factor the proxy can relay. 258 organizations compromised, 4,148 session cookies taken.
- JetBrains was breached through an unpatched instance of its own TeamCity, exposing AWS IAM credentials and secrets from a 2024 backup.
- A FreeIPA flaw chain lets an unauthenticated client pass an ownership check by being nobody, then write a Kerberos identity and password into the directory.
The big story
BigBear 2.0 does not defeat phishing-resistant authentication. It removes it from the page. CloudSEK got into the kit's admin panel and found 5,137 credential records: 4,148 session cookies, 1,032 plaintext passwords, and 474 completed MFA-bypassed authentications across 3,331 victim IPs in more than 40 countries, with at least 258 organizations compromised.
Why it matters: a passkey works by binding the assertion to the real origin, so an attacker-in-the-middle proxy cannot produce one. BigBear does not try. Custom JavaScript disables the option, and the user, shown a sign-in page that simply does not offer their security key, does the reasonable thing and uses what remains. The credential was never beaten. It was never invoked.
Every deployment keeping a phishable method enabled "for fallback" carries this exact failure. The fallback is not a safety net, it is the attack surface. The control is unpopular and direct: make phishing-resistant methods the only permitted methods for accounts that matter, enforced by a Conditional Access authentication-strength requirement that rejects the weaker method rather than merely preferring the stronger one. Source: BigBear disabled WebAuthn to force a downgrade.
Patch this week
- CVE-2026-76578, FreeIPA (CVSS 9.8), chained with CVE-2026-76560 in 389 Directory Server (CVSS 7.5). An anonymous client creates an OTP token entry with blank ownership, passes the ownership check because empty matches empty, and writes a Kerberos identity and password alongside it. Fixed in FreeIPA 4.13.4. Post.
The pattern
The FreeIPA chain is the week's best illustration of where authorization bugs actually live. Neither component is wrong on its own terms: FreeIPA assumes the directory enforces ownership, and the directory enforces ownership by string comparison. The bug exists in the gap between two implementations that each look correct in review, which is why it survived both. Same shape as the Terraform MCP cross-tenant token in August.
What else happened
- JetBrains Cadence was breached through an unpatched TeamCity running CVE-2026-63077, the flaw we covered on July 27 when the line was that every on-premises server was vulnerable. That included theirs. The attackers reached a 2024 backup, so credentials created two years earlier were still live. If your rotation covers production but not its snapshots, your effective credential lifetime is the age of your oldest backup. Post.
- The Shai-Hulud worm now scans 469 credential locations, up from 189, having added AI assistant config files to the list. The path count is really a measurement of how many places a working developer environment stores a long-lived secret. Post.
New from Start with Identity
- The newsletter got a structure: an answer-first brief, a patch list, and a pattern section, plus
scripts/verify-newsletter.mjsenforcing issue numbering, the Tuesday cadence, and section order in CI.
From the community
If you have removed password fallback at consumer scale, we want to hear how you handled recovery. The contact form reaches an editor.
That's Issue 12. Subscribe for the next one.