# OAuth

Published articles for OAuth.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore - Part 1

DevFeed: [Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore - Part 1](<https://devfeed.tech/articles/govern-ai-agent-access-with-okta-cross-app-access-and-amazon-bedrock-agentcore-part-1-121741.md>)

Original publisher: [Read original article](<https://aws.amazon.com/blogs/machine-learning/govern-ai-agent-access-with-okta-cross-app-access-and-amazon-bedrock-agentcore-part-1/>)

Author: Hammad Ausaf

Published: 2026-11-06T17:09:18Z

Content type: tutorial

Language: en

Sources: [Artificial Intelligence](<https://devfeed.tech/sources/artificial-intelligence.md>)

Topics: [Amazon Bedrock AgentCore](<https://devfeed.tech/topics/amazon-bedrock-agentcore.md>), [cross-app-access](<https://devfeed.tech/topics/cross-app-access.md>), [Access Control](<https://devfeed.tech/topics/access-control.md>), [okta](<https://devfeed.tech/topics/okta.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [AWS IAM](<https://devfeed.tech/topics/aws-iam.md>), [AI Infrastructure](<https://devfeed.tech/topics/ai-infrastructure.md>)

Tags: [access-tokens](<https://devfeed.tech/tags/access-tokens.md>), [act](<https://devfeed.tech/tags/act.md>), [admin](<https://devfeed.tech/tags/admin.md>), [agent](<https://devfeed.tech/tags/agent.md>), [agentcore](<https://devfeed.tech/tags/agentcore.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-agent-access](<https://devfeed.tech/tags/ai-agent-access.md>), [amazon](<https://devfeed.tech/tags/amazon.md>), [amazon-bedrock](<https://devfeed.tech/tags/amazon-bedrock.md>), [amazon-bedrock-agentcore](<https://devfeed.tech/tags/amazon-bedrock-agentcore.md>), [app](<https://devfeed.tech/tags/app.md>), [bedrock](<https://devfeed.tech/tags/bedrock.md>), [bedrock-agentcore](<https://devfeed.tech/tags/bedrock-agentcore.md>), [cross-app-access](<https://devfeed.tech/tags/cross-app-access.md>), [expert-400](<https://devfeed.tech/tags/expert-400.md>), [identity](<https://devfeed.tech/tags/identity.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [okta](<https://devfeed.tech/tags/okta.md>), [service-accounts](<https://devfeed.tech/tags/service-accounts.md>), [technical-how-to](<https://devfeed.tech/tags/technical-how-to.md>), [user](<https://devfeed.tech/tags/user.md>)

### AI overview

Okta Cross App Access governs which agent may act for which user, while Amazon Bedrock AgentCore carries out that decision. The BFF exchanges the user's ID token for a single-use, five-minute ID-JAG; AgentCore runtime accepts only grants issued to the configured agent; AgentCore Identity redeems each grant for a short-lived token naming both user and agent, then caches it for reuse within the request. MCP servers enforce user authority using group and scope claims. In the authors' tests, removing a user blocked new ID-JAG requests in about one second, while previously issued tokens expired within five minutes; Identity added about 0.6 seconds to an approximately 30-second request. The article also reports that plain RFC 8693 exchange carried user identity but not user authority in their Okta configuration. The walkthrough is based on an AWS sample; its snippets are conceptual, not a complete deployable solution, and are intended for non-production use.

### Source excerpt

An AI agent that acts for a user raises an identity question that per-app OAuth and service accounts leave open: which agent may act for which user, and how you stop it. In this first post of two, you build a task agent on Amazon Bedrock AgentCore that governs access through Okta Cross App Access and AgentCore Identity, and enforces each user's authority.

## Article: Identity as an Architectural Concern: Enterprise IAM Beyond Authentication

DevFeed: [Article: Identity as an Architectural Concern: Enterprise IAM Beyond Authentication](<https://devfeed.tech/articles/article-identity-as-an-architectural-concern-enterprise-iam-beyond-authentication-120951.md>)

Original publisher: [Read original article](<https://www.infoq.com/articles/identity-as-architecture/>)

Author: Vaishnavi Khosla

Published: 2026-11-06T09:00:00Z

Content type: article

Language: en

Sources: [InfoQ](<https://devfeed.tech/sources/infoq.md>)

Topics: [identity and access management](<https://devfeed.tech/topics/identity-and-access-management.md>), [Access Control](<https://devfeed.tech/topics/access-control.md>), [rbac](<https://devfeed.tech/topics/rbac.md>), [HashiCorp Vault](<https://devfeed.tech/topics/hashicorp-vault.md>), [Secure token management](<https://devfeed.tech/topics/secure-token-management.md>), [Single sign-on (SSO)](<https://devfeed.tech/topics/sso.md>), [Publish-subscribe pattern](<https://devfeed.tech/topics/pubsub.md>)

Tags: [account](<https://devfeed.tech/tags/account.md>), [architecture](<https://devfeed.tech/tags/architecture.md>), [architecture-design](<https://devfeed.tech/tags/architecture-design.md>), [article](<https://devfeed.tech/tags/article.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [based](<https://devfeed.tech/tags/based.md>), [data](<https://devfeed.tech/tags/data.md>), [design](<https://devfeed.tech/tags/design.md>), [development](<https://devfeed.tech/tags/development.md>), [don-t](<https://devfeed.tech/tags/don-t.md>), [enterprise](<https://devfeed.tech/tags/enterprise.md>), [event](<https://devfeed.tech/tags/event.md>), [experience](<https://devfeed.tech/tags/experience.md>), [governance](<https://devfeed.tech/tags/governance.md>), [graph](<https://devfeed.tech/tags/graph.md>), [iam](<https://devfeed.tech/tags/iam.md>), [identity](<https://devfeed.tech/tags/identity.md>), [identity-as-architecture](<https://devfeed.tech/tags/identity-as-architecture.md>), [identity-management](<https://devfeed.tech/tags/identity-management.md>), [java](<https://devfeed.tech/tags/java.md>), [management](<https://devfeed.tech/tags/management.md>), [models](<https://devfeed.tech/tags/models.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [rbac](<https://devfeed.tech/tags/rbac.md>), [scope](<https://devfeed.tech/tags/scope.md>), [security](<https://devfeed.tech/tags/security.md>), [service](<https://devfeed.tech/tags/service.md>), [single-sign-on](<https://devfeed.tech/tags/single-sign-on.md>), [stream](<https://devfeed.tech/tags/stream.md>)

### AI overview

At enterprise scale, identity design shapes data models, service boundaries, ownership governance, and revocation behavior. The author describes modeling ownership and time-bounded access as relationships in Neo4j, queried through GraphQL; this made common ownership and validity questions direct, though it adds datastore and modeling costs, and the article says flat RBAC remains suitable for small, single-app setups. A unified workflow for attestation, credential rotation, and vaulting reduced reported revocation time from about three days to under one. Because the vault is owned by another team, the integration fails closed and reconciles its state before marking vaulting complete. Across services, scoped OAuth 2.0 token exchange carries identity context while a policy decision point makes authorization decisions. Kafka distributes entitlement changes, so revocation is eventually consistent: consumers invalidate cached decisions, and a maximum cache age bounds stale access if an event is lost, at the cost of more source-of-truth checks when that limit is shorter.

### Source excerpt

The way you design your identities will drive your data models, your service scope, and your revocation policies; enterprise identity management is thus an architectural problem, not an afterthought. Based on our experience in service account governance, this article touches upon graph vs. RBAC, integrating a vault you don't own, and bounding revocation latency for an event stream. By Vaishnavi Khosla

## Threat actors use agentic AI tooling to find and abuse exposed secrets

DevFeed: [Threat actors use agentic AI tooling to find and abuse exposed secrets](<https://devfeed.tech/articles/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets-120855.md>)

Original publisher: [Read original article](<https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/>)

Author: Microsoft Threat Intelligence and Microsoft Security Research

Published: 2026-11-05T23:46:50Z

Content type: news

Language: en

Sources: [Microsoft Security](<https://devfeed.tech/sources/microsoft-security-blog.md>)

Topics: [Agentic AI](<https://devfeed.tech/topics/what-is-agentic-ai.md>), [Secret Scanning](<https://devfeed.tech/topics/secret-scanning.md>), [Secrets Management](<https://devfeed.tech/topics/secrets-management.md>), [threat detection](<https://devfeed.tech/topics/threat-detection.md>), [Threat monitoring](<https://devfeed.tech/topics/threat-monitoring.md>), [ai security](<https://devfeed.tech/topics/ai-security.md>)

Tags: [actions](<https://devfeed.tech/tags/actions.md>), [agentic](<https://devfeed.tech/tags/agentic.md>), [agentic-ai](<https://devfeed.tech/tags/agentic-ai.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [application](<https://devfeed.tech/tags/application.md>), [applications](<https://devfeed.tech/tags/applications.md>), [artex](<https://devfeed.tech/tags/artex.md>), [blog](<https://devfeed.tech/tags/blog.md>), [can](<https://devfeed.tech/tags/can.md>), [compromise](<https://devfeed.tech/tags/compromise.md>), [credential-theft](<https://devfeed.tech/tags/credential-theft.md>), [exposed](<https://devfeed.tech/tags/exposed.md>), [first](<https://devfeed.tech/tags/first.md>), [framework](<https://devfeed.tech/tags/framework.md>), [github](<https://devfeed.tech/tags/github.md>), [intelligence](<https://devfeed.tech/tags/intelligence.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [tooling](<https://devfeed.tech/tags/tooling.md>)

### AI overview

Microsoft reports threat actors using the ARTEX agentic offensive framework to scan public GitHub repositories for exposed credentials and then pursue cloud resources. In one observed case, an agent moved from searching for OAuth client secrets to exfiltrating Azure Key Vault data in five minutes. Follow-on activity included Entra service principal sign-ins, cloud resource discovery, credential and data access, and attempts to use Azure AI services. Microsoft says exposed credentials should be treated as compromised even if the code is later removed: revoke or rotate them, investigate historical use, review sign-in and cloud audit logs, and restrict application permissions. Recommended defenses include scanning repositories, enabling secret scanning and push protection, using managed identities where supported, applying least privilege, and protecting critical workloads. The text also describes honeypots, decoys, and tarpits as ways to divert agentic attacks, while warning that attackers can change IPs and other fingerprints. Several incident details and dates are tied to Microsoft's observations and may not represent all activity.

### Source excerpt

Microsoft Threat Intelligence has observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets, which can be used to compromise the associated OAuth application and perform authenticated actions in the application's tenant. Agents operating on behalf of threat actors then used the compromised OAuth applications to perform a variety of subsequent actions within compromised organizations. The post Threat actors use agentic AI tooling to find and abuse exposed secrets appeared first on Microsoft Security Blog.

## Let each customer bring their own OAuth app with WorkOS Pipes

DevFeed: [Let each customer bring their own OAuth app with WorkOS Pipes](<https://devfeed.tech/articles/let-each-customer-bring-their-own-oauth-app-with-workos-pipes-121081.md>)

Original publisher: [Read original article](<https://workos.com/blog/pipes-bring-your-own-oauth-app>)

Author: WorkOS

Published: 2026-11-05T00:00:00Z

Content type: article

Language: en

Sources: [WorkOS](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [OAuth](<https://devfeed.tech/topics/oauth.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>)

Tags: [admin](<https://devfeed.tech/tags/admin.md>), [api](<https://devfeed.tech/tags/api.md>), [app](<https://devfeed.tech/tags/app.md>), [application](<https://devfeed.tech/tags/application.md>), [backend](<https://devfeed.tech/tags/backend.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [custom](<https://devfeed.tech/tags/custom.md>), [customer](<https://devfeed.tech/tags/customer.md>), [data](<https://devfeed.tech/tags/data.md>), [data-integration](<https://devfeed.tech/tags/data-integration.md>), [docs](<https://devfeed.tech/tags/docs.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [secret](<https://devfeed.tech/tags/secret.md>), [widget](<https://devfeed.tech/tags/widget.md>), [workos](<https://devfeed.tech/tags/workos.md>)

### AI overview

WorkOS Pipes organization credentials let each customer register and control its own OAuth app. This is configured per provider for the whole environment: once enabled, every organization must supply a client ID and secret before its members can connect. Admins can configure credentials through the permission-gated PipesAdmin widget or API; members use the standard Pipes widget, and each member still authorizes a personal connection scoped to their organization. Setup requires creating the OAuth app, registering Pipes' redirect URI, saving the credential pair, choosing scopes, and enabling the provider. Rotation replaces the stored secret; retirement happens in the provider's console, while disabling a provider only hides it from that organization's members. The excerpt notes there is no documented remove-credentials control and no Node SDK method for the configuration API.

### Source excerpt

When a provider needs each customer's own OAuth app, the Pipes Admin widget lets their admin register it, rotate the secret and retire it without your help.

## Descope launches Envoy to let consumer apps accept personal AI agents as users

DevFeed: [Descope launches Envoy to let consumer apps accept personal AI agents as users](<https://devfeed.tech/articles/descope-launches-envoy-to-let-consumer-apps-accept-personal-ai-agents-as-users-116437.md>)

Original publisher: [Read original article](<https://siliconangle.com/2026/11/04/descope-launches-envoy-to-let-consumer-apps-accept-personal-ai-agents-as-users/>)

Author: Duncan Riley

Published: 2026-11-04T14:00:50Z

Content type: news

Language: en

Sources: [SiliconANGLE](<https://devfeed.tech/sources/siliconangle.md>)

Topics: [AI Bots](<https://devfeed.tech/topics/ai-bots.md>), [Auth0](<https://devfeed.tech/topics/auth0.md>), [agentic commerce fraud](<https://devfeed.tech/topics/agentic-commerce-fraud.md>)

Tags: [agentic](<https://devfeed.tech/tags/agentic.md>), [agentic-identity](<https://devfeed.tech/tags/agentic-identity.md>), [agentic-identity-hub](<https://devfeed.tech/tags/agentic-identity-hub.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [amazon](<https://devfeed.tech/tags/amazon.md>), [apps](<https://devfeed.tech/tags/apps.md>), [arnie-katz](<https://devfeed.tech/tags/arnie-katz.md>), [artificial-intelligence](<https://devfeed.tech/tags/artificial-intelligence.md>), [artificial-intelligence-agents](<https://devfeed.tech/tags/artificial-intelligence-agents.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [choice](<https://devfeed.tech/tags/choice.md>), [client-initiated-backchannel-authentication](<https://devfeed.tech/tags/client-initiated-backchannel-authentication.md>), [company](<https://devfeed.tech/tags/company.md>), [consumer](<https://devfeed.tech/tags/consumer.md>), [customer](<https://devfeed.tech/tags/customer.md>), [customer-identity](<https://devfeed.tech/tags/customer-identity.md>), [dell-technologies-capital](<https://devfeed.tech/tags/dell-technologies-capital.md>), [demonstrating-proof-of-possession](<https://devfeed.tech/tags/demonstrating-proof-of-possession.md>), [descope](<https://devfeed.tech/tags/descope.md>), [descope-inc](<https://devfeed.tech/tags/descope-inc.md>), [envoy](<https://devfeed.tech/tags/envoy.md>), [gofundme](<https://devfeed.tech/tags/gofundme.md>), [goodrx](<https://devfeed.tech/tags/goodrx.md>), [jpmorgan-chase](<https://devfeed.tech/tags/jpmorgan-chase.md>), [launches](<https://devfeed.tech/tags/launches.md>), [let](<https://devfeed.tech/tags/let.md>), [lightspeed-venture-partners](<https://devfeed.tech/tags/lightspeed-venture-partners.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [meta-platforms](<https://devfeed.tech/tags/meta-platforms.md>), [model-context-protocol](<https://devfeed.tech/tags/model-context-protocol.md>), [muse](<https://devfeed.tech/tags/muse.md>), [news](<https://devfeed.tech/tags/news.md>), [nitin-shingate](<https://devfeed.tech/tags/nitin-shingate.md>), [notable-capital](<https://devfeed.tech/tags/notable-capital.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [personal](<https://devfeed.tech/tags/personal.md>), [personal-agent-protocol](<https://devfeed.tech/tags/personal-agent-protocol.md>), [personal-ai](<https://devfeed.tech/tags/personal-ai.md>), [personal-ai-agents](<https://devfeed.tech/tags/personal-ai-agents.md>), [poppy](<https://devfeed.tech/tags/poppy.md>), [rich-authorization-requests](<https://devfeed.tech/tags/rich-authorization-requests.md>), [security](<https://devfeed.tech/tags/security.md>), [sierra-technologies](<https://devfeed.tech/tags/sierra-technologies.md>), [the-latest](<https://devfeed.tech/tags/the-latest.md>), [users](<https://devfeed.tech/tags/users.md>)

### AI overview

Descope's Envoy lets consumer apps accept personal AI agents with identities separate from their customers, while keeping existing customer sign-in systems in place. It handles agent discovery and identification under the draft Personal Agent Protocol (Poppy), and binds session tokens to an agent-held key using Demonstrating Proof of Possession. Businesses can scope permissions through OAuth Rich Authorization Requests, set access duration, and require customer approval for sensitive actions through Client-Initiated Backchannel Authentication. Tokens and logs record both customer and agent, allowing an agent's access to be revoked without signing out the customer. Envoy supports all three sign-in types in the Poppy draft; Descope says developers need not implement the protocol or track revisions themselves. The article describes the protocol as a 0.1 draft and names GoFundMe and GoodRx as launch and design partners.

### Source excerpt

Customer and agentic identity platform company Descope Inc. today launched Envoy, a service that lets consumer websites and apps accept personal artificial intelligence agents acting for their customers without rebuilding how people sign in. Agents arriving through Envoy get an identity of their own, separate from the customer's. The launch goes after a choice consumer businesses [...] The post Descope launches Envoy to let consumer apps accept personal AI agents as users appeared first on SiliconANGLE.

## Canonical adds FIDO2 hardware key support to Launchpad

DevFeed: [Canonical adds FIDO2 hardware key support to Launchpad](<https://devfeed.tech/articles/canonical-adds-fido2-hardware-key-support-to-launchpad-115752.md>)

Original publisher: [Read original article](<https://www.omgubuntu.co.uk/2026/11/launchpad-fido2-hardware-tokens>)

Author: Joey Sneddon

Published: 2026-11-03T17:05:51Z

Content type: release

Language: en

Sources: [OMG! Ubuntu](<https://devfeed.tech/sources/omg-ubuntu.md>)

Topics: [WebAuthn](<https://devfeed.tech/topics/webauthn.md>), [canonical](<https://devfeed.tech/topics/canonical.md>), [Ubuntu](<https://devfeed.tech/topics/ubuntu.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [api-access](<https://devfeed.tech/tags/api-access.md>), [canonical](<https://devfeed.tech/tags/canonical.md>), [developer-tools](<https://devfeed.tech/tags/developer-tools.md>), [developers](<https://devfeed.tech/tags/developers.md>), [fido2](<https://devfeed.tech/tags/fido2.md>), [hardware](<https://devfeed.tech/tags/hardware.md>), [key](<https://devfeed.tech/tags/key.md>), [launchpad](<https://devfeed.tech/tags/launchpad.md>), [login](<https://devfeed.tech/tags/login.md>), [malware](<https://devfeed.tech/tags/malware.md>), [news](<https://devfeed.tech/tags/news.md>), [nfc](<https://devfeed.tech/tags/nfc.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [ppas](<https://devfeed.tech/tags/ppas.md>), [security](<https://devfeed.tech/tags/security.md>), [support](<https://devfeed.tech/tags/support.md>), [token](<https://devfeed.tech/tags/token.md>), [ubuntu](<https://devfeed.tech/tags/ubuntu.md>), [usb](<https://devfeed.tech/tags/usb.md>)

### AI overview

Launchpad now supports hardware-bound API tokens for developers who want to protect access to higher-privilege accounts. Instead of relying on a saved token alone, the flow protects a long-lived OAuth refresh grant with a USB FIDO2 key; touching the key and entering its PIN issues a short-lived token for requests. Malware running during a logged-in session could still use that short-lived token, but cannot use the protected grant to request another. Setup requires a supported USB key and the `python3-fido2` package. NFC keys and device-stored passkeys are not supported.

### Source excerpt

Developers who use Launchpad can now use a USB FIDO2 security key to restrict API access, which makes any stolen login details useless without it. Launchpad is, as I'm sure you know, where Canonical builds Ubuntu's package, hosts code, PPAs and many other things that end up on a users' system. Developer tools, like lp-shell and ubuntu-archive-tools, log in with a saved token, normally kept as a text file or in the desktop keyring on the developer's machine. Anyone who gets hold of it, malware included, could act as them, with the permissions it carries. Canonical's Jürgen Gmach says "for most people that [...] You're reading Canonical adds FIDO2 hardware key support to Launchpad, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

## Keycloak's observability journey: a guide for project maintainers

DevFeed: [Keycloak's observability journey: a guide for project maintainers](<https://devfeed.tech/articles/keycloak-s-observability-journey-a-guide-for-project-maintainers-113142.md>)

Original publisher: [Read original article](<https://opentelemetry.io/blog/2026/devex-keycloak/>)

Author: OpenTelemetry Authors; Docs CC BY

Published: 2026-11-02T15:39:10Z

Content type: article

Language: en

Sources: [OpenTelemetry](<https://devfeed.tech/sources/blog-on-opentelemetry.md>)

Topics: [OpenTelemetry](<https://devfeed.tech/topics/opentelemetry.md>), [observability](<https://devfeed.tech/topics/observability.md>), [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [Prometheus](<https://devfeed.tech/topics/prometheus.md>)

Tags: [access-management](<https://devfeed.tech/tags/access-management.md>), [cncf](<https://devfeed.tech/tags/cncf.md>), [guide](<https://devfeed.tech/tags/guide.md>), [iam](<https://devfeed.tech/tags/iam.md>), [identity-and-access-management](<https://devfeed.tech/tags/identity-and-access-management.md>), [interviews](<https://devfeed.tech/tags/interviews.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [observability](<https://devfeed.tech/tags/observability.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [opentelemetry](<https://devfeed.tech/tags/opentelemetry.md>), [saml](<https://devfeed.tech/tags/saml.md>)

### AI overview

Keycloak's maintainers found that the OpenTelemetry Java agent enabled quick experimentation but added dozens of seconds to startup, so they moved to native Quarkus integration to preserve fast startup. Metrics gave immediate value; tracing helped locate database and LDAP bottlenecks, and exemplars linked metric spikes to representative traces for investigating high-percentile latency. OpenTelemetry support is on by default, but users must enable a component such as tracing to export data. The source also flags operational tradeoffs: unlike pull-based Prometheus, push-based telemetry over an open TCP socket lacks built-in backpressure and raises questions about signal origin and overload. Keycloak uses custom identity-provider attribute prefixes because conventions are not standardized, and its maintainers call for clearer guides and validation tools such as Weaver.

### Source excerpt

As part of an ongoing series, the Developer Experience SIG interviews organizations about their real-world OpenTelemetry deployments to share practical lessons with the broader community. This post features Keycloak, a CNCF project, and looks at the journey from the perspective of project maintainers who add native OpenTelemetry support to the software they ship. If you have ever needed an Identity and Access Management (IAM) solution, there is a good chance Keycloak was on your radar: a widely used, community-driven open source IAM system that secures applications by authenticating both human and non-human users through industry-standard protocols such as OpenID Connect (OIDC), OAuth 2.0, and SAML.

## Managed Better Auth is now an OAuth provider, with MCP support

DevFeed: [Managed Better Auth is now an OAuth provider, with MCP support](<https://devfeed.tech/articles/managed-better-auth-is-now-an-oauth-provider-with-mcp-support-113443.md>)

Original publisher: [Read original article](<https://neon.com/blog/managed-better-auth-oauth-provider-mcp>)

Author: Shridhar Deshmukh

Published: 2026-11-02T12:00:00Z

Content type: release

Language: en

Sources: [Neon Docs](<https://devfeed.tech/sources/blog-neon-docs.md>)

Topics: [OAuth](<https://devfeed.tech/topics/oauth.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [pkce](<https://devfeed.tech/topics/pkce.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [apis](<https://devfeed.tech/tags/apis.md>), [auth](<https://devfeed.tech/tags/auth.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [clients](<https://devfeed.tech/tags/clients.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [plugin](<https://devfeed.tech/tags/plugin.md>), [product](<https://devfeed.tech/tags/product.md>), [server](<https://devfeed.tech/tags/server.md>)

### AI overview

Managed Better Auth's OAuth Provider plugin makes an auth instance an OAuth 2.1 authorization server for companion apps and MCP clients. In Managed Better Auth, the OAuth provider and MCP support are configured together: add login and consent page URLs and an MCP server URL. Neon runs discovery, keys, token issuance and refresh, and client onboarding; developers run the login and consent pages and the API or MCP server. The `@neon/oauth` SDK verifies MCP tokens' signature, issuer and audience, and provides adapters for Hono, Next.js and `node:http`. MCP clients can onboard with Client ID Metadata Documents by default, while older clients may use optional dynamic registration. OAuth configuration is per database branch; branches share signing keys but have distinct issuers, which issuer-pinning verifiers use to reject preview tokens in production. The feature is available now and included in all Neon plans; the Free plan covers up to 60,000 monthly active users.

### Source excerpt

Managed Better Auth now supports the OAuth Provider plugin. It turns your auth instance into an OAuth 2.1 authorization server, so other apps and MCP clients can sign users in with your app.

## CVE-2026-61826 - Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery

DevFeed: [CVE-2026-61826 - Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery](<https://devfeed.tech/articles/cve-2026-61826-bazarr-plex-oauth-api-namespace-is-entirely-unauthenticated-allowing-config-tampering-integration-takeover-and-server-side-request-forgery-109182.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-61826>)

Author: CVEFEED.io; github.com

Published: 2026-10-30T17:17:27Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [API](<https://devfeed.tech/topics/api.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [account takeover](<https://devfeed.tech/topics/account-takeover.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [account](<https://devfeed.tech/tags/account.md>), [api](<https://devfeed.tech/tags/api.md>), [api-key](<https://devfeed.tech/tags/api-key.md>), [apis](<https://devfeed.tech/tags/apis.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [bazarr](<https://devfeed.tech/tags/bazarr.md>), [beta](<https://devfeed.tech/tags/beta.md>), [bind](<https://devfeed.tech/tags/bind.md>), [config](<https://devfeed.tech/tags/config.md>), [credential-exposure](<https://devfeed.tech/tags/credential-exposure.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-61826](<https://devfeed.tech/tags/cve-2026-61826.md>), [denial-of-service](<https://devfeed.tech/tags/denial-of-service.md>), [forgery](<https://devfeed.tech/tags/forgery.md>), [integration](<https://devfeed.tech/tags/integration.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [plex](<https://devfeed.tech/tags/plex.md>), [server-side-request-forgery](<https://devfeed.tech/tags/server-side-request-forgery.md>)

### AI overview

Before Bazarr 1.5.7-beta.14, handlers in the Plex OAuth API namespace lack authentication, allowing anonymous callers to alter persistent configuration, disable or take over the Plex integration, and expose the configured API key. Attacker-controlled server URLs can trigger outbound requests carrying that key in `X-Plex-Token`, creating SSRF and credential-exposure risks. Version 1.5.7-beta.14 adds authentication to close the anonymous API-mutation path. The source does not establish complete OAuth state validation; it identifies that as a separate unresolved concern.

### Source excerpt

CVE ID :CVE-2026-61826 Published : Oct. 30, 2026, 5:17 p.m. | 1 hour, 57 minutes ago Description :Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke `POST /api/plex/oauth/logout` to clear credentials and disable the integration, or `POST /api/plex/apikey` to persist an attacker-selected key, without a PIN, account or state precondition. `POST /api/plex/oauth/pin` and `GET /api/plex/oauth/pin//check` additionally allow an attacker who completes a PIN with an attacker-controlled Plex account to bind that account's token to the instance. `PlexPinCheck` skips state validation when `state_param` is absent and merely logs a mismatch without stopping execution. `POST /api/plex/select-server`, `POST /api/plex/oauth/servers`, `POST /api/plex/webhook/create`, `POST /api/plex/webhook/delete` and `POST /api/plex/encrypt-apikey` expose further `write_config()` operations. Attacker-controlled server URLs feed later outbound requests carrying the configured API key in `X-Plex-Token`, enabling server-side request forgery and credential exposure in addition to persistent configuration tampering and integration denial of service. Version 1.5.7-beta.14 closes the anonymous API-mutation path by adding authentication; complete OAuth state validation is not established and remains a separate residual for curator review. Severity: 10.0 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

## CVE-2026-59387 - Broken access control restriction in Cloud Controller API

DevFeed: [CVE-2026-59387 - Broken access control restriction in Cloud Controller API](<https://devfeed.tech/articles/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api-107520.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-59387>)

Author: cvefeed.io

Published: 2026-10-30T08:47:59Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [Access Control](<https://devfeed.tech/topics/access-control.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [rbac](<https://devfeed.tech/topics/rbac.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [access-control](<https://devfeed.tech/tags/access-control.md>), [api](<https://devfeed.tech/tags/api.md>), [broken-access-control](<https://devfeed.tech/tags/broken-access-control.md>), [build](<https://devfeed.tech/tags/build.md>), [callback](<https://devfeed.tech/tags/callback.md>), [cf-deployment](<https://devfeed.tech/tags/cf-deployment.md>), [cloudfoundry](<https://devfeed.tech/tags/cloudfoundry.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [controller](<https://devfeed.tech/tags/controller.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-59387](<https://devfeed.tech/tags/cve-2026-59387.md>), [metadata](<https://devfeed.tech/tags/metadata.md>), [mutual-tls](<https://devfeed.tech/tags/mutual-tls.md>), [nginx](<https://devfeed.tech/tags/nginx.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [privilege-escalation](<https://devfeed.tech/tags/privilege-escalation.md>), [process](<https://devfeed.tech/tags/process.md>), [public](<https://devfeed.tech/tags/public.md>), [routing](<https://devfeed.tech/tags/routing.md>), [sidecar](<https://devfeed.tech/tags/sidecar.md>)

### AI overview

Cloud Controller's Nginx configuration blocks unauthenticated access to /internal/v4/ and /internal/v5/ but omits the equivalent restriction for /internal/v3/. This leaves the staging callbacks /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed reachable through the public API without OAuth or mutual TLS. With a valid build or droplet GUID, an attacker can forge a callback to move a droplet to STAGED and persist process metadata and sidecar data without an associated package or actor. The description says a SpaceAuditor can enumerate GUIDs without write permissions, enabling privilege escalation beyond that role's intended boundary. The source rates the issue 8.8 (HIGH) and marks it remotely exploitable; it does not provide affected versions.

### Source excerpt

CVE ID :CVE-2026-59387 Published : Oct. 30, 2026, 8:47 a.m. | 18 minutes ago Description :The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

## We've built the fastest way to create a one-click remote MCP server by mistake

DevFeed: [We've built the fastest way to create a one-click remote MCP server by mistake](<https://devfeed.tech/articles/we-ve-built-the-fastest-way-to-create-a-one-click-remote-mcp-server-by-mistake-109522.md>)

Original publisher: [Read original article](<https://appwrite.io/blog/post/one-click-remote-mcp-server-by-mistake>)

Author: Eldad Fux

Published: 2026-10-30T00:00:00Z

Content type: article

Language: en

Sources: [Appwrite Blog](<https://devfeed.tech/sources/appwrite-blog.md>)

Topics: [Back end](<https://devfeed.tech/topics/backend.md>), [implementation](<https://devfeed.tech/topics/implementation.md>), [Serverless](<https://devfeed.tech/topics/serverless.md>), [client](<https://devfeed.tech/topics/client.md>), [Remote Procedure Call (RPC)](<https://devfeed.tech/topics/rpc.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Server-side rendering](<https://devfeed.tech/topics/server-side-rendering.md>), [OpenAPI Specification](<https://devfeed.tech/topics/openapi.md>)

Tags: [access-tokens](<https://devfeed.tech/tags/access-tokens.md>), [agent](<https://devfeed.tech/tags/agent.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-tool](<https://devfeed.tech/tags/ai-tool.md>), [ai-tools](<https://devfeed.tech/tags/ai-tools.md>), [api](<https://devfeed.tech/tags/api.md>), [auth](<https://devfeed.tech/tags/auth.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [chatgpt](<https://devfeed.tech/tags/chatgpt.md>), [claude](<https://devfeed.tech/tags/claude.md>), [claude-code](<https://devfeed.tech/tags/claude-code.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [email](<https://devfeed.tech/tags/email.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-server](<https://devfeed.tech/tags/mcp-server.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [production](<https://devfeed.tech/tags/production.md>), [remote-mcp-server](<https://devfeed.tech/tags/remote-mcp-server.md>)

### AI overview

An Appwrite project can host a remote MCP server with OAuth 2.1 authorization, consent, and user-scoped data access already integrated. The example server uses protected resource metadata and a 401 challenge for discovery, then verifies signed access tokens offline against the project's JWKS, checking issuer, the server-specific audience, token type, and scopes. Its tools are exposed only when the user's approved scopes permit them, with scope checks repeated on each call. The server can run as a Function on its own domain or as an SSR Site route; the example uses a Function and returns plain JSON per request, so streaming tools need a different design. The approach is fast because hosting, identity, and data share a project, though that consolidates those services on one platform. The OAuth2 server is currently an Appwrite Cloud feature, not available in self-hosted Appwrite. Revoking consent prevents new tokens, while already issued offline-verified tokens remain usable until expiry, one hour by default for public clients.

### Source excerpt

We built an email client on Appwrite to test a new feature, then asked an agent for a remote MCP server with OAuth 2.1. It was in production in under a minute.

## Google Adopts DPoP to Strengthen OAuth 2.0 Against Token Theft and Replay Attacks

DevFeed: [Google Adopts DPoP to Strengthen OAuth 2.0 Against Token Theft and Replay Attacks](<https://devfeed.tech/articles/google-adopts-dpop-to-strengthen-oauth-2-0-against-token-theft-and-replay-attacks-106786.md>)

Original publisher: [Read original article](<https://www.infoq.com/news/2026/10/google-dpop-oauth2/>)

Author: Sergio De Simone

Published: 2026-10-29T19:00:00Z

Content type: news

Language: en

Sources: [InfoQ](<https://devfeed.tech/sources/infoq.md>)

Topics: [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [Credential theft](<https://devfeed.tech/topics/credential-theft.md>), [credential-based attacks](<https://devfeed.tech/topics/credential-based-attacks.md>), [Secure token management](<https://devfeed.tech/topics/secure-token-management.md>), [frontend security](<https://devfeed.tech/topics/frontend-security.md>)

Tags: [adversary](<https://devfeed.tech/tags/adversary.md>), [adversary-in-the-middle-aitm](<https://devfeed.tech/tags/adversary-in-the-middle-aitm.md>), [agent](<https://devfeed.tech/tags/agent.md>), [agent-workflows](<https://devfeed.tech/tags/agent-workflows.md>), [api](<https://devfeed.tech/tags/api.md>), [architecture-design](<https://devfeed.tech/tags/architecture-design.md>), [bearer](<https://devfeed.tech/tags/bearer.md>), [browser](<https://devfeed.tech/tags/browser.md>), [client](<https://devfeed.tech/tags/client.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [cloud-security](<https://devfeed.tech/tags/cloud-security.md>), [cookies](<https://devfeed.tech/tags/cookies.md>), [credential-theft](<https://devfeed.tech/tags/credential-theft.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [cryptographic](<https://devfeed.tech/tags/cryptographic.md>), [cryptography](<https://devfeed.tech/tags/cryptography.md>), [development](<https://devfeed.tech/tags/development.md>), [google](<https://devfeed.tech/tags/google.md>), [google-dpop-oauth2](<https://devfeed.tech/tags/google-dpop-oauth2.md>), [news](<https://devfeed.tech/tags/news.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [proof-of-possession](<https://devfeed.tech/tags/proof-of-possession.md>), [security](<https://devfeed.tech/tags/security.md>), [theft](<https://devfeed.tech/tags/theft.md>), [token](<https://devfeed.tech/tags/token.md>)

### AI overview

Google OAuth supports DPoP for refresh tokens, binding them to a client-generated asymmetric key so a stolen token cannot be replayed without the private key. Access tokens remain bearer tokens; the text says applying DPoP to each request would add cryptographic verification overhead. Clients must manage keys, timestamps, nonces, HTTP headers and DPoP proof JWTs. DPoP does not protect web session cookies; Google and WICG are developing DBSC to bind browser cookies to device hardware. For multi-agent delegation, the text points to Google Cloud STS to exchange an upstream token for a short-lived federated token bound to the next agent's key. Because browser-held keys remain exposed to client-side misuse, the cited IETF guidance recommends a Backend-for-Frontend pattern; a zero-persistence approach is also proposed where server infrastructure is unavailable.

### Source excerpt

Google's OAuth Platform has recently introduces support for Demonstrating Proof-of-Possession (DPoP), an OAuth 2.0 security mechanism designed to mitigate token theft and replay attacks. By Sergio De Simone

## FusionAuth 1.70: least privilege for your customers' AI agents

DevFeed: [FusionAuth 1.70: least privilege for your customers' AI agents](<https://devfeed.tech/articles/fusionauth-1-70-least-privilege-for-your-customers-ai-agents-106727.md>)

Original publisher: [Read original article](<https://fusionauth.io/blog/announcing-fusionauth-1-70>)

Author: Andrew Hatfield

Published: 2026-10-29T00:00:00Z

Content type: article

Language: en

Sources: [FusionAuth](<https://devfeed.tech/sources/fusionauth-blog.md>)

Topics: [AI Bots](<https://devfeed.tech/topics/ai-bots.md>), [AI Integration Strategies](<https://devfeed.tech/topics/ai-integration-strategies.md>), [agentic workflows](<https://devfeed.tech/topics/agentic-workflows.md>)

Tags: [access-control](<https://devfeed.tech/tags/access-control.md>), [access-tokens](<https://devfeed.tech/tags/access-tokens.md>), [actor](<https://devfeed.tech/tags/actor.md>), [agent](<https://devfeed.tech/tags/agent.md>), [agentic](<https://devfeed.tech/tags/agentic.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [ciam](<https://devfeed.tech/tags/ciam.md>), [cimd](<https://devfeed.tech/tags/cimd.md>), [client](<https://devfeed.tech/tags/client.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [exchange](<https://devfeed.tech/tags/exchange.md>), [least-privilege](<https://devfeed.tech/tags/least-privilege.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [metadata](<https://devfeed.tech/tags/metadata.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [policy](<https://devfeed.tech/tags/policy.md>), [product](<https://devfeed.tech/tags/product.md>), [rfc](<https://devfeed.tech/tags/rfc.md>), [rfc-8693](<https://devfeed.tech/tags/rfc-8693.md>), [security](<https://devfeed.tech/tags/security.md>), [token](<https://devfeed.tech/tags/token.md>), [token-exchange](<https://devfeed.tech/tags/token-exchange.md>), [users](<https://devfeed.tech/tags/users.md>)

### AI overview

FusionAuth 1.70 adds CIMD registration and RFC 8693 token exchange to give AI assistants distinct client identities and narrowly scoped delegation tokens. CIMD fetches and validates client metadata from allow-listed domains; server-side configuration and registration lambdas control scopes, with PKCE and user consent required. Token exchange lets an MCP server authenticate as an Entity and request a short-lived token for a downstream operation. The Entity Policy Engine passes FusionAuth-issued subject-token scopes through unchanged; the Lambda Policy Engine can accept approved external JWTs and narrow permissions, audience, and lifespan. Exchanged tokens retain user context and identify the acting service with an `act` claim, while downstream APIs must enforce token scopes. Recorded Intent is logged for review but is neither validated nor used to authorize access. Exchange attempts are logged for seven days by default (configurable from 1 to 31) and can be streamed to a SIEM. CIMD and token exchange require the Enterprise plan.

### Source excerpt

FusionAuth 1.70 introduces Client ID Metadata Document (CIMD) registration and RFC 8693 token exchange, giving engineering teams a secure, policy-driven model for AI agents acting on behalf of users.

## FusionAuth 1.70 Lets Companies Securely Open Their Apps to Customers' AI Agents

DevFeed: [FusionAuth 1.70 Lets Companies Securely Open Their Apps to Customers' AI Agents](<https://devfeed.tech/articles/fusionauth-1-70-lets-companies-securely-open-their-apps-to-customers-ai-agents-106728.md>)

Original publisher: [Read original article](<https://fusionauth.io/blog/fusionauth-1-70-press-release>)

Author: Andrew Hatfield

Published: 2026-10-29T00:00:00Z

Content type: release

Language: en

Sources: [FusionAuth](<https://devfeed.tech/sources/fusionauth-blog.md>)

Topics: [AI Bots](<https://devfeed.tech/topics/ai-bots.md>), [Secure token management](<https://devfeed.tech/topics/secure-token-management.md>), [Single sign-on (SSO)](<https://devfeed.tech/topics/sso.md>)

Tags: [access-management](<https://devfeed.tech/tags/access-management.md>), [accessibility](<https://devfeed.tech/tags/accessibility.md>), [account](<https://devfeed.tech/tags/account.md>), [agent](<https://devfeed.tech/tags/agent.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [ai-apps](<https://devfeed.tech/tags/ai-apps.md>), [ai-tool](<https://devfeed.tech/tags/ai-tool.md>), [ai-tools](<https://devfeed.tech/tags/ai-tools.md>), [apps](<https://devfeed.tech/tags/apps.md>), [ciam](<https://devfeed.tech/tags/ciam.md>), [cimd](<https://devfeed.tech/tags/cimd.md>), [connect](<https://devfeed.tech/tags/connect.md>), [customers](<https://devfeed.tech/tags/customers.md>), [exchange](<https://devfeed.tech/tags/exchange.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [news](<https://devfeed.tech/tags/news.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [press-release](<https://devfeed.tech/tags/press-release.md>), [product](<https://devfeed.tech/tags/product.md>), [support](<https://devfeed.tech/tags/support.md>), [token](<https://devfeed.tech/tags/token.md>), [token-exchange](<https://devfeed.tech/tags/token-exchange.md>)

### AI overview

FusionAuth 1.70 adds CIMD support and OAuth token exchange for companies connecting MCP-compatible AI apps to customer accounts. CIMD lets apps register automatically under company-defined rules, enabling customers to sign in and approve access without manual registration. With OAuth token exchange (RFC 8693), services can request access to another system on a customer's behalf; companies can restrict granted permissions, and FusionAuth records each attempt and policy decision. An optional intent statement is also added to the audit record, extending the RFC 8693 exchange record. FusionAuth suggests starting agents with least-privilege access and reviewing records during testing to determine needed permissions. The features are available today on the Enterprise plan, deployable in FusionAuth Cloud or customer-controlled environments, with no per-exchange charge.

### Source excerpt

CIMD support and OAuth token exchange let companies connect MCP-compatible AI apps and govern access on behalf of customers.

## CVE-2026-118669 - OAuthLib: Token grants can use attacker-supplied client\_id for authorization after authenticating a different client

DevFeed: [CVE-2026-118669 - OAuthLib: Token grants can use attacker-supplied client\_id for authorization after authenticating a different client](<https://devfeed.tech/articles/cve-2026-118669-oauthlib-token-grants-can-use-attacker-supplied-client-id-for-authorization-after-authenticating-a-different-client-105595.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-118669>)

Author: CVEFEED.io; github.com

Published: 2026-10-28T22:17:12Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [OAuth](<https://devfeed.tech/topics/oauth.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [client](<https://devfeed.tech/tags/client.md>), [cve-2026-118669](<https://devfeed.tech/tags/cve-2026-118669.md>), [fixed](<https://devfeed.tech/tags/fixed.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [python](<https://devfeed.tech/tags/python.md>), [scopes](<https://devfeed.tech/tags/scopes.md>), [token](<https://devfeed.tech/tags/token.md>)

### AI overview

Before OAuthLib 4.0.0, the client_credentials and Resource Owner Password Credentials handlers could authenticate one confidential client but use an attacker-supplied client_id when validating grant types and scopes. A lower-privilege authenticated client could potentially obtain tokens with unauthorized grants or scopes if the application's validators rely on the documented client_id argument; validators that authorize only from request.client may not be affected. The issue is fixed in OAuthLib 4.0.0. The excerpt lists no affected products.

### Source excerpt

CVE ID :CVE-2026-118669 Published : Oct. 28, 2026, 10:17 p.m. | 1 hour, 12 minutes ago Description :OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0. Severity: 8.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

## CVE-2026-106013 - Jupiter X Core \<= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth\_verifier Parameter

DevFeed: [CVE-2026-106013 - Jupiter X Core \<= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth\_verifier Parameter](<https://devfeed.tech/articles/cve-2026-106013-jupiter-x-core-4-61-0-unauthenticated-authentication-bypass-via-twitter-x-social-login-oauth-verifier-parameter-102855.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-106013>)

Author: CVEFEED.io; wordfence.com

Published: 2026-10-28T02:17:01Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [Authentication](<https://devfeed.tech/topics/authentication.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [Access Control](<https://devfeed.tech/topics/access-control.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [artbees](<https://devfeed.tech/tags/artbees.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authentication-bypass](<https://devfeed.tech/tags/authentication-bypass.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [core](<https://devfeed.tech/tags/core.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-106013](<https://devfeed.tech/tags/cve-2026-106013.md>), [jupiter-x-core](<https://devfeed.tech/tags/jupiter-x-core.md>), [login](<https://devfeed.tech/tags/login.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [parameter](<https://devfeed.tech/tags/parameter.md>), [social](<https://devfeed.tech/tags/social.md>), [twitter](<https://devfeed.tech/tags/twitter.md>), [x](<https://devfeed.tech/tags/x.md>)

### AI overview

Jupiter X Core versions through 4.61.0 are described as vulnerable to unauthenticated WordPress account takeover through Twitter/X social login. In verify_twitter_callback, the plugin exchanges the visitor's oauth_verifier but does not assign the returned credentials to the TwitterOAuth client. The subsequent verification request therefore uses the site operator's stored tokens, returns the X application owner's profile, and the plugin authenticates the WordPress account matching that profile's email. The source says this account is typically the site administrator.

### Source excerpt

CVE ID :CVE-2026-106013 Published : Oct. 28, 2026, 2:17 a.m. | 29 minutes ago Description :The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causing the subsequent account/verify_credentials API call to remain signed with the site operator's stored Access Token and Access Token Secret rather than the authenticating visitor's token. This causes the X API to return the profile of the X application owner instead of the signing-in visitor, and the plugin then resolves and authenticates a WordPress account solely by matching that owner's email address via wp_set_auth_cookie(), allowing unauthenticated attackers to gain authenticated access as the WordPress user whose email corresponds to the X app owner, who is typically the site administrator. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

## Apache Polaris with Spark 4: REST Catalog, OAuth, and Credential Vending

DevFeed: [Apache Polaris with Spark 4: REST Catalog, OAuth, and Credential Vending](<https://devfeed.tech/articles/apache-polaris-with-spark-4-rest-catalog-oauth-and-credential-vending-102845.md>)

Original publisher: [Read original article](<https://www.dremio.com/blog/apache-polaris-with-spark-4-rest-catalog-oauth-and-credential-vending/>)

Author: Alex Merced

Published: 2026-10-27T18:56:45Z

Content type: tutorial

Language: en

Sources: [Dremio](<https://devfeed.tech/sources/dremio.md>)

Topics: [Apache Spark](<https://devfeed.tech/topics/spark.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [REST API](<https://devfeed.tech/topics/rest-api.md>)

Tags: [apache-iceberg](<https://devfeed.tech/tags/apache-iceberg.md>), [apache-polaris](<https://devfeed.tech/tags/apache-polaris.md>), [catalog](<https://devfeed.tech/tags/catalog.md>), [connect](<https://devfeed.tech/tags/connect.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [data-lakehouse](<https://devfeed.tech/tags/data-lakehouse.md>), [dremio-blog-open-data-insights](<https://devfeed.tech/tags/dremio-blog-open-data-insights.md>), [iceberg](<https://devfeed.tech/tags/iceberg.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [rest](<https://devfeed.tech/tags/rest.md>), [scopes](<https://devfeed.tech/tags/scopes.md>), [spark](<https://devfeed.tech/tags/spark.md>), [storage](<https://devfeed.tech/tags/storage.md>), [verify](<https://devfeed.tech/tags/verify.md>)

### AI overview

The excerpt gives a versioned recipe for connecting Spark 4 to Apache Polaris 1.8 as an Iceberg REST catalog: align Polaris client JARs with the documented compatibility matrix, configure OAuth client credentials and scope, set the warehouse and vended-credential header, and map temporary credentials into the storage FileIO. A namespace and managed-table write/read smoke test checks catalog and object-store access; metadata success with S3 AccessDenied points to credentials not reaching or being applied by the FileIO. Polaris vends credentials only for physical tables managed under its storage rules, not generic Iceberg tables. The excerpt also recommends checking driver, executor, and monitoring logs for exposed OAuth secrets or temporary credentials, and validating networking and IAM permissions before a staged rollout. Exact property names and non-AWS behavior depend on the documented client and cloud configuration.

### Source excerpt

Connect Spark 4 to Apache Polaris with the Iceberg REST catalog, OAuth credentials, catalog scopes, and storage credential vending, then verify writes. The post Apache Polaris with Spark 4: REST Catalog, OAuth, and Credential Vending appeared first on Dremio.

## CVE-2026-116672 - Authlib RFC 7592 examples omit registration-access-token client binding

DevFeed: [CVE-2026-116672 - Authlib RFC 7592 examples omit registration-access-token client binding](<https://devfeed.tech/articles/cve-2026-116672-authlib-rfc-7592-examples-omit-registration-access-token-client-binding-102358.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-116672>)

Author: CVEFEED.io; github.com

Published: 2026-10-27T16:31:48Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [Authorization](<https://devfeed.tech/topics/authorization.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [interception](<https://devfeed.tech/topics/interception.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [authlib](<https://devfeed.tech/tags/authlib.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [changes](<https://devfeed.tech/tags/changes.md>), [cve-2026-116672](<https://devfeed.tech/tags/cve-2026-116672.md>), [examples](<https://devfeed.tech/tags/examples.md>), [fixed](<https://devfeed.tech/tags/fixed.md>), [interception](<https://devfeed.tech/tags/interception.md>), [library](<https://devfeed.tech/tags/library.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [openid](<https://devfeed.tech/tags/openid.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [python](<https://devfeed.tech/tags/python.md>), [redirect](<https://devfeed.tech/tags/redirect.md>), [reference](<https://devfeed.tech/tags/reference.md>), [request](<https://devfeed.tech/tags/request.md>), [rfc](<https://devfeed.tech/tags/rfc.md>), [servers](<https://devfeed.tech/tags/servers.md>), [target](<https://devfeed.tech/tags/target.md>), [token](<https://devfeed.tech/tags/token.md>)

### AI overview

Authlib's documented RFC 7592 reference implementations, from version 0.15 until 1.9.1, can let a client with any valid registration access token read, modify, or delete another client's registration. They use the request's client_id to select the target and check whether it is editable, but do not verify that request.credential belongs to that client. Changing redirect_uris may enable authorization code or token interception; deleting registrations may deny service. The issue is fixed in version 1.9.1.

### Source excerpt

CVE ID :CVE-2026-116672 Published : Oct. 27, 2026, 4:31 p.m. | 54 minutes ago Description :Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

## CVE-2026-92885 - Qode Membership \<= 2.0.6.2 - Authentication Bypass via Social Login

DevFeed: [CVE-2026-92885 - Qode Membership \<= 2.0.6.2 - Authentication Bypass via Social Login](<https://devfeed.tech/articles/cve-2026-92885-qode-membership-2-0-6-2-authentication-bypass-via-social-login-101918.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-92885>)

Author: CVEFEED.io; wordfence.com

Published: 2026-10-27T09:16:34Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [Authentication](<https://devfeed.tech/topics/authentication.md>), [account takeover](<https://devfeed.tech/topics/account-takeover.md>), [Secure token management](<https://devfeed.tech/topics/secure-token-management.md>), [conditionals](<https://devfeed.tech/topics/conditionals.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [account](<https://devfeed.tech/tags/account.md>), [account-takeover](<https://devfeed.tech/tags/account-takeover.md>), [administrator](<https://devfeed.tech/tags/administrator.md>), [ajax](<https://devfeed.tech/tags/ajax.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authentication-bypass](<https://devfeed.tech/tags/authentication-bypass.md>), [cve-2026-92885](<https://devfeed.tech/tags/cve-2026-92885.md>), [exploitation](<https://devfeed.tech/tags/exploitation.md>), [facebook](<https://devfeed.tech/tags/facebook.md>), [graph](<https://devfeed.tech/tags/graph.md>), [login](<https://devfeed.tech/tags/login.md>), [network](<https://devfeed.tech/tags/network.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [plugin](<https://devfeed.tech/tags/plugin.md>), [public](<https://devfeed.tech/tags/public.md>), [token](<https://devfeed.tech/tags/token.md>), [variable](<https://devfeed.tech/tags/variable.md>), [verification](<https://devfeed.tech/tags/verification.md>), [wordpress](<https://devfeed.tech/tags/wordpress.md>)

### AI overview

Qode Membership for WordPress versions up to and including 2.0.6.2 has a critical authentication bypass in the Facebook social-login AJAX action. A variable-name typo makes the OAuth token verification guard ineffective, leaving the authentication-cookie function reachable without credential or token validation. An unauthenticated attacker could log in as an existing account, including an administrator, by providing its login name in the response[email] parameter. Exploitation requires a valid qode_validate_facebook_login nonce, which the excerpt says is available on public pages using the [qode_user_login] or [qode_user_register] shortcode. The excerpt rates the issue CVSS 9.8.

### Source excerpt

CVE ID :CVE-2026-92885 Published : Oct. 27, 2026, 9:16 a.m. | 1 hour, 28 minutes ago Description :The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function -- the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account -- including Administrator-level accounts -- by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without any prior authentication. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

## Mobile Session Architecture: Tokens, Refresh, Device Binding, Logout, and Risk-Based Expiry

DevFeed: [Mobile Session Architecture: Tokens, Refresh, Device Binding, Logout, and Risk-Based Expiry](<https://devfeed.tech/articles/mobile-session-architecture-tokens-refresh-device-binding-logout-and-risk-based-expiry-100957.md>)

Original publisher: [Read original article](<https://proandroiddev.com/mobile-session-architecture-tokens-refresh-device-binding-logout-and-risk-based-expiry-7f7a64de3955?source=rss----c72404660798---4>)

Author: Vaibhav Shakya | Mr Neo

Published: 2026-10-26T23:23:25Z

Content type: article

Language: en

Sources: [ProAndroidDev](<https://devfeed.tech/sources/proandroiddev-medium.md>)

Topics: [Secure token management](<https://devfeed.tech/topics/secure-token-management.md>), [sessions](<https://devfeed.tech/topics/sessions.md>), [Access Control](<https://devfeed.tech/topics/access-control.md>), [synchronization](<https://devfeed.tech/topics/synchronization.md>), [App attestation](<https://devfeed.tech/topics/app-attestation.md>), [Secrets Management](<https://devfeed.tech/topics/secrets-management.md>)

Tags: [account](<https://devfeed.tech/tags/account.md>), [android](<https://devfeed.tech/tags/android.md>), [android-app-development](<https://devfeed.tech/tags/android-app-development.md>), [androiddev](<https://devfeed.tech/tags/androiddev.md>), [api](<https://devfeed.tech/tags/api.md>), [apis](<https://devfeed.tech/tags/apis.md>), [app](<https://devfeed.tech/tags/app.md>), [application](<https://devfeed.tech/tags/application.md>), [architecture](<https://devfeed.tech/tags/architecture.md>), [audit](<https://devfeed.tech/tags/audit.md>), [auth](<https://devfeed.tech/tags/auth.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [backend](<https://devfeed.tech/tags/backend.md>), [business](<https://devfeed.tech/tags/business.md>), [changes](<https://devfeed.tech/tags/changes.md>), [consistency](<https://devfeed.tech/tags/consistency.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [detection](<https://devfeed.tech/tags/detection.md>), [device](<https://devfeed.tech/tags/device.md>), [mobile](<https://devfeed.tech/tags/mobile.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [refresh](<https://devfeed.tech/tags/refresh.md>), [risk](<https://devfeed.tech/tags/risk.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

### AI overview

A mobile session is broader than its tokens: where device management, rapid revocation, replay detection, or risk controls matter, the article recommends server-managed session state tied to a device key, with separate bounded-lifetime access tokens and revocable refresh tokens. It describes rotating refresh tokens as an atomic server-side state transition, coordinated by a single-flight client refresh flow; ambiguous reuse can still reflect retries or races, so response policies should account for them. Cryptographic key binding can protect selected requests, while device-integrity signals should inform risk rather than prove trust. Logout must revoke server state when reachable and clear local credentials, but already issued self-contained access tokens may remain valid until expiry unless services check current state. Idle and absolute expiry, step-up authentication, and risk-based controls should govern sensitive operations. The excerpt also highlights tradeoffs in revocation speed, service availability, and failure handling, and notes that secure storage reduces extraction risk without making a compromised client trustworthy.

### Source excerpt

Authentication in a mobile application is often described as a simple sequence: the user logs in, receives a token, and sends that token with subsequent API requests. That explanation is technically correct but architecturally incomplete. A production mobile session spans several independently changing systems: A mobile application that may remain installed for years An access credential with a deliberately bounded lifetime A longer-lived authorization grant, when refresh capability is issued A device or app-instance identity Server-side session state Account, role, password, and risk changes Multiple API services with different consistency characteristics Logout and revocation events that must propagate across the platform The central architectural mistake is treating the token as the session. A token is only a credential representing part of a session's authority. For systems requiring device management, replay detection, rapid revocation, or risk-based controls, the broader session should be represented by server-managed security state with its own lifecycle, device association, risk state, revocation state, and audit history. Start With a Server-Side Session Model After successful authentication, the backend should create a session record rather than merely issue a pair of tokens. A practical session model might contain: session_id user_id device_key_id refresh_token_family_id current_refresh_token_verifier previous_refresh_token_verifier refresh_generation status created_at last_seen_at idle_expires_at absolute_expires_at risk_level auth_strength revoked_at revocation_reason The mobile application receives: A short-lived access token A longer-lived refresh token A session identifier, directly or indirectly The server's current session-policy metadata The access token is used with resource APIs. The refresh token is sent only to the authorization or session service. It should not be attached to normal business requests. The backend retains enough state to decide

## Discover 1000+ services on Vercel Connect from the CLI

DevFeed: [Discover 1000+ services on Vercel Connect from the CLI](<https://devfeed.tech/articles/discover-1000-services-on-vercel-connect-from-the-cli-100655.md>)

Original publisher: [Read original article](<https://vercel.com/changelog/discover-1000-services-on-vercel-connect-from-the-cli>)

Author: Bhrigu Srivastava

Published: 2026-10-26T18:19:23.427320Z

Content type: release

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [Vercel](<https://devfeed.tech/topics/vercel.md>), [Terminal](<https://devfeed.tech/topics/terminal.md>), [AI connector platforms](<https://devfeed.tech/topics/ai-connector-platforms.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [categories](<https://devfeed.tech/tags/categories.md>), [cli](<https://devfeed.tech/tags/cli.md>), [commands](<https://devfeed.tech/tags/commands.md>), [connect](<https://devfeed.tech/tags/connect.md>), [docs](<https://devfeed.tech/tags/docs.md>), [filter](<https://devfeed.tech/tags/filter.md>), [format](<https://devfeed.tech/tags/format.md>), [json](<https://devfeed.tech/tags/json.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [product](<https://devfeed.tech/tags/product.md>), [results](<https://devfeed.tech/tags/results.md>), [scripts](<https://devfeed.tech/tags/scripts.md>), [search](<https://devfeed.tech/tags/search.md>), [service](<https://devfeed.tech/tags/service.md>), [services](<https://devfeed.tech/tags/services.md>), [support](<https://devfeed.tech/tags/support.md>), [terminal](<https://devfeed.tech/tags/terminal.md>), [vercel](<https://devfeed.tech/tags/vercel.md>)

### AI overview

Vercel CLI 64.1.0 or later lets you discover more than 1,000 Vercel Connect services from the terminal. `vercel connect discover` searches names, aliases, keywords, and descriptions; results can be filtered by category, connection method (including `mcp` and `oauth`), exposed product, or webhook trigger support. `vercel connect categories` lists filterable category slugs. Both commands support `--format=json` for scripts and agents, and a discovered service can be passed to `vercel connect create`, as in `vercel connect create slack`.

### Source excerpt

You and your agents can now browse and search more than 1000 services available in Vercel Connect without leaving your terminal. vercel connect discover searches by name, alias, keyword, and description. type: embedded-entry-inline id: H1F06IGrASdIU5HbPDOFM Results can be filtered by category, connection method (such as mcp or oauth) or the product a service exposes. You can also limit results to services that forward webhook triggers. vercel connect categories lists the category slugs you can filter by. Both commands support --format=json for scripts and agents. type: embedded-entry-inline id: 3qxhz833AJeAwUqgX6LAZi You can then pass the service name while creating any connector to the command: Update to version 64.1.0 or later of the CLI to get started, and read the Vercel Connect CLI docs to learn more. Read more

## Create a Flask Application With Google Login

DevFeed: [Create a Flask Application With Google Login](<https://devfeed.tech/articles/create-a-flask-application-with-google-login-100530.md>)

Original publisher: [Read original article](<https://realpython.com/flask-google-login/>)

Author: Alexander VanTol

Published: 2026-10-26T14:00:00Z

Content type: tutorial

Language: en

Sources: [Real Python](<https://devfeed.tech/sources/real-python.md>)

Topics: [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Flask](<https://devfeed.tech/topics/flask.md>), [Single sign-on (SSO)](<https://devfeed.tech/topics/sso.md>), [Google](<https://devfeed.tech/topics/google.md>)

Tags: [flask](<https://devfeed.tech/tags/flask.md>), [google](<https://devfeed.tech/tags/google.md>), [google-account](<https://devfeed.tech/tags/google-account.md>), [login](<https://devfeed.tech/tags/login.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [python](<https://devfeed.tech/tags/python.md>)

### AI overview

The example Flask app uses Google's OpenID Connect flow to authenticate users and Flask-Login to maintain their browser sessions, so the app does not store passwords. After registering a Google web client and configuring its ID and secret as environment variables, the app requests the `openid`, `email`, and `profile` scopes. It exchanges the returned authorization code for tokens, retrieves profile data, checks `email_verified`, stores the user's Google ID, name, email, and picture in SQLite, and logs them in. The excerpt uses `oauthlib` with `requests` for the OAuth/OIDC requests and notes that its provider-configuration and API calls need stronger error handling for robustness. Local testing uses Flask's development server with an ad hoc HTTPS certificate, which triggers a browser warning; the article suggests a real certificate for deployment.

### Source excerpt

Build a Python Flask app with Google login so users can sign in with their Google account, and learn OAuth 2, OpenID Connect, and Flask-Login.

## window.opener and target="\_blank": The Tabnabbing Risk Explained

DevFeed: [window.opener and target="\_blank": The Tabnabbing Risk Explained](<https://devfeed.tech/articles/window-opener-and-target-blank-the-tabnabbing-risk-explained-100737.md>)

Original publisher: [Read original article](<https://markodenic.com/window-opener/>)

Author: Marko

Published: 2026-10-26T09:00:00Z

Content type: article

Language: en

Sources: [Marko Denic Blog](<https://devfeed.tech/sources/marko-denic-blog.md>)

Topics: [frontend security](<https://devfeed.tech/topics/frontend-security.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [browsers](<https://devfeed.tech/tags/browsers.md>), [html](<https://devfeed.tech/tags/html.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [links](<https://devfeed.tech/tags/links.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [reverse](<https://devfeed.tech/tags/reverse.md>), [risk](<https://devfeed.tech/tags/risk.md>), [target](<https://devfeed.tech/tags/target.md>), [web-development](<https://devfeed.tech/tags/web-development.md>), [window](<https://devfeed.tech/tags/window.md>)

### AI overview

A page opened in a new tab can't read a cross-origin opener's content, but historically it could change the opener's location and redirect it to a phishing page (reverse tabnabbing). The excerpt recommends `rel="noopener"` on external `target="_blank"` links and the `noopener` feature in `window.open()`; `noreferrer` also hides the referring URL. Major browsers have treated `_blank` links as `noopener` by default since around 2021, but explicit protection remains useful for older browsers and security audits. The `Cross-Origin-Opener-Policy` header can sever opener links; `same-origin-allow-popups` preserves certain popup flows. When a login or payment popup must report back, use `postMessage` with an explicit target origin and validate the received `event.origin`.

### Source excerpt

What window.opener is, how reverse tabnabbing attacks used target="_blank" links, why rel="noopener" fixes it, what browsers do by default today, and how popups like OAuth logins should communicate instead.

## Giving a personal agent access to your email without regret

DevFeed: [Giving a personal agent access to your email without regret](<https://devfeed.tech/articles/giving-a-personal-agent-access-to-your-email-without-regret-100639.md>)

Original publisher: [Read original article](<https://www.swytchcode.com/content/personal-agent-email-access>)

Author: Chaitrali Kakde

Published: 2026-10-26T09:00:00Z

Content type: article

Language: en

Sources: [Swytchcode](<https://devfeed.tech/sources/swytchcode.md>)

Topics: [email](<https://devfeed.tech/topics/email.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [Credential theft](<https://devfeed.tech/topics/credential-theft.md>), [Hacking](<https://devfeed.tech/topics/hacking.md>), [online privacy](<https://devfeed.tech/topics/online-privacy.md>), [human in the loop agent](<https://devfeed.tech/topics/human-in-the-loop-agent.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [archiving](<https://devfeed.tech/tags/archiving.md>), [audit](<https://devfeed.tech/tags/audit.md>), [auth](<https://devfeed.tech/tags/auth.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [bank](<https://devfeed.tech/tags/bank.md>), [banking](<https://devfeed.tech/tags/banking.md>), [body](<https://devfeed.tech/tags/body.md>), [build](<https://devfeed.tech/tags/build.md>), [compose](<https://devfeed.tech/tags/compose.md>), [confidence](<https://devfeed.tech/tags/confidence.md>), [email](<https://devfeed.tech/tags/email.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [personal-agent](<https://devfeed.tech/tags/personal-agent.md>), [product](<https://devfeed.tech/tags/product.md>), [risks](<https://devfeed.tech/tags/risks.md>), [scope](<https://devfeed.tech/tags/scope.md>), [send](<https://devfeed.tech/tags/send.md>)

### AI overview

Start with Gmail `gmail.readonly` plus `gmail.compose`: the agent can read and create drafts, while you retain control of sending. The text warns that sending introduces social risks such as mistaken messages and reply-all, and that `mail.google.com` also permits permanent deletion. Read access still exposes security codes and reset links, so narrow mailbox queries and exclude security mail; filters reduce common exposure but are not airtight. Email can also carry prompt injection, making limited capabilities, narrow connections, treating message bodies as data, and reviewing audit logs useful safeguards. If sending is added later, the examples require approval for new recipients and deny messages to more than three recipients. The described setup stores OAuth tokens locally in encrypted storage and attaches them at call time. Similar narrow-permission principles are said to apply to Microsoft Graph and limited-rights IMAP app passwords.

### Source excerpt

An agent that can read your email is one product. An agent that can send is a different product with different risks. The OAuth scope you pick decides which one you built.

[Next page](<https://devfeed.tech/tags/oauth.md?cursor=WyIyMDI2LTEwLTI2VDA5OjAwOjAwKzAwOjAwIiwgIjYzZWNlNmE2LThiODMtNDhmNS1hMTZkLWQ3Zjc1NDk5ZDE4YSJd>)