Between September 26 and October 17, 2026, nine distinct identity-layer bypasses appeared across every tier of the authentication stack. Each exploited the same structural assumption: that an assertion from a trusted source means what the receiving system assumes it means. The incidents span framework, library, plugin, appliance, identity provider, low-code, utility, browser-side, and implementation-layer SaaS plumbing. The breadth of the failure – not confined to a single vendor, protocol, or layer – marks a shift from isolated misconfigurations to an architectural pattern.
The progression began at the framework layer. Keycloak masked-secret reuse (Post 131948, CVE-2026-15943) allowed a delegated administrator to redirect the token URL without re-entering the stored secret. The secret followed the redirect because the framework trusted the administrator’s action without re-validating the credential binding. It was a configuration-layer trust gap: the system assumed the stored context remained valid after the target changed.
The library layer failed next. Better Auth OAuth state reuse (Post 132071, CVE-2026-110862) allowed implicit account linking through the IdP’s email_verified assertion alone. The framework trusted the identity provider’s claim as sufficient proof to bind accounts without cross-checking the local verification state. CVSS 9.3. The gap was between what the IdP asserted and what the local system assumed that assertion meant for account ownership.
The plugin layer repeated the pattern. Frontegg SAML SSO for WordPress (Post 132087, CVE-2026-75800) failed to validate SAML assertion signatures and issuers. An attacker could forge an assertion, and the plugin would process it as genuine because it never checked whether the signature was valid. The trust was structural: SAML was assumed authentic by default.
The appliance layer produced the most operationally costly failure. Citrix NetScaler SAML RCE (Post 132019, CVE-2026-107406) was the second emergency patch on the same SAML trust surface in one week. The October 3 fix builds – the exact versions deployed to close CVE-2026-88779 – sat inside the October 8 bulletin’s affected range. Administrators who patched on October 3 were running vulnerable software by October 8. The trap repeated because the system trusted the patch cycle itself.
The identity provider layer followed. AD FS spoofing CVEs (Post 132106, CVE-2026-108131/96222) arrived the same day DKM key enforcement activated. Two spoofing vulnerabilities in the IdP itself, disclosed during a hardening rollout, exposed the tension between enforcement timing and vulnerability disclosure. The identity provider was the trust anchor; the CVEs showed the anchor was already compromised.
The low-code layer produced the most accessible exploit. Budibase OIDC invite hijacking (Post 132121, CVE-2026-100684) allowed an attacker controlling an account at a trusted IdP to claim another user’s pending invite during the OIDC login flow. The invite-matching logic bound invites by email address alone – no invite-code validation, no email_verified check on the invite-claim path. CVSS 9.2. The system trusted the IdP’s email assertion as proof of invite entitlement.
The utility layer revealed how defaults can undo fixes. OAuth2 Proxy header bypass (Post 132161, CVE-2026-76835) was a case where a security fix existed, but the default configuration continued to trust the spoofable header. The gap was not between IdP and application but between the developer’s intent and the runtime’s behavior.
The browser-side layer hardened the surface from the other direction. Microsoft Entra CSP enforcement on sign-in pages (Post 132185) blocked unauthorized script injection at login.microsoftonline.com. This was not a vulnerability but a structural countermeasure: the browser-side enforcement layer for agent identity. Its inclusion in the timeline matters because it shows the defense responding to the same architectural gap from the opposite direction.
The ninth incident moved the failure into the plumbing itself. WorkOS SAML SSO dual-view XML parsing gap (Post 132192) parsed the same SAML response with two different XML views – one for signature verification, one for attribute extraction. A crafted response could present different content to each view. The signature verified; the application processed attacker-controlled identity fields. This is not a misconfiguration. It is an engineering architecture problem: the vendor’s own code trusted two independent reads of the same document without binding them.
The pattern across all nine is identical: a system trusted an assertion without verifying that the assertion means what the system assumed. In the first seven, the gap existed between the identity provider’s claim and the local binding. In the WorkOS case, the gap moved one layer deeper – between the signature verifier’s view and the application’s view of the same document. The defense response (Entra CSP) addressed the browser-side surface. The problem has now reached every layer.
This is not a burst of coincidental disclosures. It is a structural pattern under stress. Agent identity systems depend on the same federation layers that produced these nine failures. The authentication stack was not built for the trust assumptions that agent-to-agent and agent-to-service communication now require. Each bypass followed the same path: assume the upstream assertion is valid, skip the local binding check, and process whatever the trusted source delivered. The identity stack needs a different architecture – one that validates the binding at every layer, not just the perimeter.
