Skip to content
Start with Identity
Join free
This Week in Identity · Issue 21 · 2026-11-10 · Covers 2026-11-04 to 2026-11-10

This Week in Identity, Issue 21

Issue 21 of This Week in Identity. The theme this week is the session, not the password. Two breach disclosures turned on live sessions that worked without a password or a second factor, and one platform started making stolen sessions useless away from the device they were issued to. The patch list is heavy on authentication logic that failed open.

In brief

  • Chainalysis said on November 4 that names, usernames, password hashes and live tokens for all users were exposed, reversing its October 30 statement that no session tokens were accessed; every user will have to reset passwords and rotate API keys when access returns.
  • DreamHost's breach notice says an attacker who exploited its web File Manager captured the FTP/SFTP credentials of people who logged in from about August to October 23, 2026, and may have exposed webmail session data, mailbox contents and site files.
  • Vercel has begun rolling out Device Bound Session Credentials for vercel.com sign-ins in Chrome on Mac and Windows, so a session cookie copied to another machine soon stops working; DPoP for its command-line tool is in progress.

The big story

Chainalysis goes from "no session tokens" to live tokens for every user in five days. The blockchain analysis firm first disclosed on October 30 that an external actor using "offensive agentic techniques" had reached its systems and internal tools, exposing user IDs, names, email addresses and organization role labels, and said it had no evidence that session tokens were accessed. On November 2 it took Reactor and Data Solutions offline. On November 4 it said an "on-path attack" had exposed a subset of customer passwords, then took KYT, address screening and its login page offline after abnormal activity, and said customer names, usernames, password hashes and live tokens for all users had been exposed. It says it found no evidence that investigations data was accessed or attribution data manipulated.

Why it matters: the control that failed is the bearer session. A valid session or API token works without the password and without the second factor, so turning on MFA after the fact does nothing for a token already taken; only revocation and rotation do, which is why Chainalysis is forcing both. The other lesson is about disclosure: a first statement describes what has been checked, not what happened, so rotate on the first notice rather than waiting for the scope to settle. If you are a customer, rotate API keys and reset passwords through the official login page, not emailed links. The technique is token replay, and device-bound session credentials are the control that makes a stolen session hard to reuse. Source: Chainalysis now says password hashes and live tokens for all users were exposed.

Patch this week

  • OpenSSH 10.6p2 (November 5) works around a password authentication bypass in sshd on Linux systems built with musl libc and PAM disabled, such as Alpine. An oversized password can log in to accounts whose shadow field is "*", including root on Alpine, when password authentication is on and another account has a real password. Run apk upgrade openssh or set PasswordAuthentication no. glibc systems and PAM setups are not affected. Post.
  • Apache OFBiz 24.09.08 (November 4) fixes CVE-2026-105330, a hard-coded JWT signing key that allows unauthenticated admin access, CVE-2026-109928, a password reset flaw allowing full account takeover, CVE-2026-82907, a reusable login key not bound to a session, and REST operations left open by default (CVE-2026-92887). Every earlier version is affected. After upgrading, invalidate sessions and replace any JWT signing key. Post.
  • Docker Sandboxes v0.51.0 (November 3) fixes CVE-2026-103916 (CVSS 3.1 8.2): sbx cp followed symlinks without consulting the allowlist, so an AI agent inside the sandbox could steer a copy to host files such as ~/.aws/credentials or ~/.ssh/authorized_keys. An earlier fix in v0.48.0 was incomplete. Post.

The pattern

A session is a credential, and this week attackers collected them. Chainalysis lost live tokens for every user. DreamHost's attacker reached webmail systems that held session information, which is why DreamHost ended sessions instead of only resetting passwords. OFBiz shipped a login key that was accepted before authentication and not bound to a session. The technique page for the class is session cookie theft, and the usual supplier is an infostealer. The countermeasure arrived the same week: Vercel binding its dashboard sessions to a key held in the device's secure hardware. Two things follow for your own apps. On an incident, revoke sessions and tokens as a separate step from password resets. And for high-value sessions, bind them to the device with DBSC in the browser and DPoP for API tokens, so a copy is worth little.

What else happened

  • DreamHost: the California filing gives August 15, 2026 as the breach date, so the attacker collected passwords at the login form for about ten weeks; how a host stores passwords does not matter when the form itself is the collection point. Reset mail and FTP passwords, check mailboxes for forwarding rules you did not create, and review site files. Post.
  • DigiCert is notifying customers that self-registered accounts with no application assigned read archived customer records between June 27 and July 2, 2026, including a small minority of driver's licenses, passports and utility bills submitted for validation. Certificates were not affected. The control that failed is deny by default, and the archive was identity proofing evidence, exactly what an impersonator wants. Post.
  • Trigger.dev said an attacker read environment variables for "a subset of organizations" and has not said how or how many. It is the fourth developer platform in three weeks to lose customer environment variables, after Zeabur, Railway and Northflank. Rotate every secret stored there even without the email. Post.
  • Vercel's rollout comes after its own April incident began with an employee's Google Workspace account taken over through a compromised third-party AI tool. DBSC does not stop an attacker already on the device and covers browser sessions only, so CLI and API tokens stay bearer tokens until DPoP ships. Post.
  • Kantara Initiative's Digital Identity Risk group concluded that AI agents need their own risk framework, naming orphaned agent identities, dormant credentials, "identity drift" and agents posing as humans. It lines up with NIST's ten design tenets for agent identity, which start with distinct agent identification and include least and zero standing privilege. Post.
  • DigiD was only partly reachable for about 90 minutes after an October 30 DDoS, blocking logins to the Dutch tax office and MijnOverheid before a VAT deadline. Availability is down to 99.57% this year against a 99.5% norm. No credential was stolen, but when one login fronts a country's services, its uptime is everyone's. Post.

New from SWI research

New from Start with Identity

Free to read and share. Independent and community-driven, no sponsorship. Subscribe to get the next issue.