#oauth
-
Flaw in the Official MCP Python SDK Lets Malicious Servers Steal OAuth Credentials
A rogue MCP server could trick an app built on the official Python SDK into handing over its client secret, authorization code, and PKCE proof key. Fixes are in versions 1.30.0 and 2.2.0.
-
F5 Patches Critical BIG-IP APM Zero-Day Allowing Unauthenticated RCE
CVE-2026-94127 threatens only systems where the APM module acts as an OAuth authorization server. F5 has shipped engineering hotfixes while attacks are already under way.
-
Twitch Extension Leaked OAuth Tokens of Nearly 31,000 Users
The malicious browser extension “Twitch Enhanced Viewer | JeetBot” forwarded viewers' session tokens to the proxy servers of a commercial bot service — except for the sessions of ten Russian streamers.
-
Password-Spraying Attacks Surge 155-Fold Because of MFA Gaps
In the first half of 2026, Huntress recorded a 155-fold increase in password-spraying attacks. In just two weeks, one campaign generated over 81 million login attempts by exploiting legacy authentication and gaps in multi-factor protection policies.
-
Bluesky proposes a private-data protocol for ATProto
The Bluesky team has published a draft of Permissioned Data — an AT Protocol extension that adds data with an access boundary to “public broadcasting”: bookmarks, drafts, paid content and private groups.
-
Microsoft Details Three Scenarios for ShinyHunters' Attacks on Salesforce
Microsoft analyzed a year-long ShinyHunters campaign against corporate Salesforce environments, noting that the attackers did not exploit platform vulnerabilities but instead abused trusted OAuth connections.