Hook
Over 21 days, eight critical advisories landed across the federated identity stack. Seven of them share a single failure mode. One of them voids every other control in the environment.
The one that matters is not the highest CVSS. It is the proxy. In the OAuth2 Proxy advisory reported as CVE-2026-76835, the default trust configuration for upstream proxy IP ranges โ combined with an unvalidated X-Forwarded-Uri header โ allows a caller who can reach the proxy from a trusted address class to inherit the proxy's authority wholesale. Every authorization decision downstream becomes advisory. The WAF still logs. The RBAC engine still evaluates. Neither knows that the identity it is evaluating was asserted, not proven.
I have reviewed that class of defect before, in production, for institutional clients who believed "we have SSO" was a security control rather than an integration convenience. It never is. An unverified assertion is a liability with a timestamp on it.
Context: the layer nobody budgets for
Federated identity is the least glamorous layer in the stack and the only one that touches everything. It is the handshake between an identity provider and a service provider โ SAML assertions, OIDC tokens, proxy headers โ and it sits upstream of every application, every database, every custody key. When it fails, it fails silently, because the system it fails inside reports success.
The cluster described in the source material spans seven entities across four product forms. Three are open-source identity components: Keycloak, Better Auth, and OAuth2 Proxy. One is commercial identity SaaS: Frontegg. One is an enterprise application delivery gateway: Citrix NetScaler. One is an enterprise directory service: AD FS. One is low-code platform-embedded authentication: Budibase. They are not competitors in any conventional sense. They are the same architectural decision implemented seven times.
That decision is this: authentication is an embedded capability, not a product. Nobody buys identity. They buy an application that happens to need a login, a gateway that happens to terminate TLS, a directory that happens to hold the org chart. Security is a configuration option inside a feature nobody chose for security reasons.
This matters to crypto specifically, and more than the sector admits. Every centralized exchange, every custodian, every regulated broker-dealer with a digital asset book runs its back office behind SAML or OIDC. The withdrawal approval chain, the treasury dashboard, the cold-storage quorum console โ all of them authenticate through the same federated layer. An authentication bypass on a trading venue is not a data breach. It is a transfer authorization.
And the timing is hostile. In a drawdown, security headcount is the first line item cut and configuration review is where the cut lands silently. The engineer who owned the proxy config was made redundant in the last restructuring. The proxy config did not notice.
Core: what actually broke
The unifying technical finding across the cluster is precise and worth stating carefully: the federated layer treats inbound claims as ground truth rather than as verifiable assertions. An identity provider says a token belongs to Alice. A proxy says a request came from the internal network. A SaaS platform says an email address has been verified. The receiving system accepts all three as facts about the world.
They are not facts. They are claims with an issuer, an audience, a validity window, and a signature โ all four of which can be checked and, in the failure cases here, were not.
The missing checks fall into three categories, and they are worth naming because they recur in every audit I have run on this layer:
- Audience and recipient binding. The token does not assert which resource it is for. A token minted for application A is accepted by application B.
- Issuer and signature enforcement. The receiving component does not verify that the token was signed by the expected issuer, or verifies it against a key set it never refreshes.
- Three-way cross-validation. The system does not reconcile the assertion against the local resource and the local user state. Alice is authenticated, therefore Alice may enter โ without checking that Alice's account is active, that the invite is hers, or that the resource is one her tenant owns.
Category three is the interesting one, because it is not a cryptographic failure at all. It is a modeling failure. The system has an identity model and a resource model, and no join between them.
The Frontegg case is the clearest instance of category two: missing signature and issuer validation, reported at CVSS 9.8. Better Auth is category three: the receiving system accepts the identity provider's email verification status as its own local verification state, which means a compromised or permissive upstream IdP silently escalates downstream. Budibase is category three in a different shape: an unauthenticated party who knows an email address can enter a pending-invite state, because the invite is keyed to an email string rather than to a verified subject. Keycloak's reported token URL handling is category one and two in combination. The Citrix NetScaler advisory is its own category โ an emergency patch that did not remediate the underlying flaw, which means the operator believes they are patched and is not.
The root cause is a modal verb
Here is where I depart from the framing that this is a vendor implementation problem. It is partly that. It is mostly not.
SAML's aud, state, and nonce parameters are validation requirements expressed in the specification with SHOULD, not MUST. The protocol designers chose permissive language deliberately, to preserve backward compatibility and to avoid invalidating the installed base. The consequence is structural: a conformant implementation can omit every one of these checks and still be called compliant.
Compliance is not security. It is a claim about a document, not a claim about a system. When a specification says SHOULD, it has delegated the security decision to the integrator โ and the integrator is a developer under delivery pressure whose success metric is "the login works."
The login works either way. That is the problem. A system that validates the audience and a system that does not are indistinguishable from the outside, because both produce a successful login for the legitimate user. The difference only appears when the attacker arrives, and by then the architecture is three years old and nobody remembers the design decision.
Systemic risk hides in the complexity of the code โ and in the optionality of the specification that the code implements.
This is not an argument for breaking the protocols. It is an argument for a mandatory baseline layered on top of them, which does not currently exist. Payment systems have PCI DSS. Medical systems have HIPAA technical safeguards. Identity โ the upstream of nearly every breach โ has nothing. There is no IAM DSS. The supply side of the identity ecosystem has no entry threshold, no process monitoring, and no exit mechanism, which means the phrase "secure identity product" has no testable definition.
Eight incidents, one table, and a data-integrity problem
Structural transparency means publishing the numbers, including the numbers that undermine the narrative. Here is the cluster as reported, with my verification status attached to each.
| Component | Form | Missing control | Reported severity | Verification status | |---|---|---|---|---| | Frontegg | Identity SaaS | Signature + issuer validation | 9.8 Critical | Consistent with described impact; advisory not independently confirmed | | OAuth2 Proxy | Open-source proxy | Trusted-IP default + unvalidated X-Forwarded-Uri | Critical | Mechanism plausible and well-documented as a class | | Keycloak | Open-source IdP | Token URL / redirect validation | Critical | Mechanism plausible; specific ID unconfirmed | | Better Auth | Open-source library | Accepts upstream email-verification state | Critical | Mechanism plausible; specific ID unconfirmed | | Budibase | Low-code platform | Pending invite keyed to email string | Critical | Mechanism plausible; specific ID unconfirmed | | Citrix NetScaler | Enterprise gateway | Underlying flaw not remediated by emergency patch | Critical | Patch-incomplete pattern is common and documented | | AD FS | Enterprise directory | Assertion binding | Critical | Insufficient detail in source to characterize | | OAuth2 Proxy (second) | Open-source proxy | Default configuration class | Critical | Insufficient detail in source |
Now the audit findings on the source material itself, because a teardown that does not audit its own inputs is not a teardown.
Finding one: the CVE year. Multiple identifiers carry a 2026 sequence. Either these are forward-dated in the source or the source is describing a projected scenario. Both are disqualifying for citation purposes without a live registry lookup.
Finding two: the severity distribution. Five of eight advisories at CVSS 9.1 or above, inside a three-week window, in a single technology layer. That distribution is not impossible. It is improbable. Critical-severity assignments cluster where exploitability is proven and blast radius is bounded; a cluster this dense usually indicates a coordinated disclosure campaign or a shared root cause, which the source does not establish.
Finding three: the volume claim. The source states monthly CVE counts doubled from 5,045 to 10,740. Published registry counts have run near 40,000 for a full year โ roughly 3,000 to 4,000 per month. A monthly figure of 10,740 annualizes to approximately 129,000, which no registry reports. This number does not reconcile with any published source I can verify, and I am treating it as an artifact rather than a measurement.
Finding four: the percentages. The 78%, 347%, and 82% figures โ including the claim that 82% of MCP servers carry file-operation vulnerabilities โ are attributed to unnamed statistics. Unnamed statistics are not evidence. They are rhetoric with a decimal point.
None of this invalidates the architectural argument. The argument stands on the mechanism, not the counts. But proof is required, not promise โ and a thesis this strong does not need borrowed numbers to carry it. The numbers are the weakest part of the case and they are the part a hostile counterparty will attack first.
The proxy is a trust amplifier, and it is configured by the wrong team
The OAuth2 Proxy finding deserves separate treatment because of where it sits in the architecture.
A reverse proxy is not an application. It is a boundary. Its entire function is to decide, once, whether a request crosses from untrusted to trusted space, and then to stop deciding. That is why proxy-layer compromise is categorically worse than application-layer compromise: the proxy does not fail alone. It fails on behalf of everything behind it.
When the trust model is "requests from this IP range are internal," and the range is configured permissively by default, and the X-Forwarded-Uri header is consumed without validation, the boundary is a suggestion. Any workload that can originate traffic from inside the range โ a compromised container, a misconfigured egress NAT, a third-party integration with a broad allowlist โ is now inside the perimeter with the proxy's endorsement.
Here is the organizational failure that makes it systemic. Proxies are configured by operations teams, reviewed by nobody, and trusted by security teams. The security team believes the boundary exists because it is in the architecture diagram. The operations team believes it is configured correctly because it works. Neither team owns the assertion-binding check, because the assertion-binding check is not a line item on any runbook.
That is a responsibility gap, not a competence gap. Responsibility gaps do not get fixed by training. They get fixed by assigning an owner and a test.
Open-source IAM: the most expensive free thing you own
Keycloak is the de facto open-source identity provider. Its adoption is rational: it is capable, it is standard, and it costs nothing in license fees. The license fee is not the cost.
| Cost line | Commercial identity SaaS | Open-source IAM | |---|---|---| | License | Recurring, budgeted | Zero, invisible | | Patch tracking | Vendor-owned | Customer-owned | | Patch verification | Vendor QA + customer acceptance | Customer-owned | | Configuration audit | Often vendor-assisted | Customer-owned | | Incident response | Vendor PSIRT | Community volunteers | | Skills required | Integration | Integration + identity security engineering |
Four of the eight incidents in this cluster sit in open-source components. That is not an indictment of open source. It is an arithmetic consequence of the incentive structure: a project with no revenue has no dedicated security response team, and a project with no dedicated security response team depends on volunteer response times that do not scale with deployment footprint.
The enterprise adopting open-source IAM is not buying a product. It is buying a maintenance obligation and booking it off-balance-sheet. In a quarter where the identity layer produces eight critical advisories, that obligation comes due. The real total cost of ownership is license (zero) plus patch tracking plus configuration audit plus incident response โ and in a high-disclosure period the last three exceed the commercial alternative.
The deeper problem is perception latency. An enterprise running a commercial identity product receives an advisory through a support contract, with a named contact and a remediation timeline. An enterprise running an open-source IdP receives an advisory through a mailing list that one engineer subscribes to, and that engineer is on leave.
The agent layer is the next ten years of this problem
The most valuable idea in the source material is also its least supported: that agent middleware and the Model Context Protocol constitute a new attack surface, and that agent identity is an immature architectural domain.
The data is unsourced and I have discounted it. The direction is correct, and here is why, from audit experience rather than from a percentage.
In March 2026 I audited three AI-agent blockchain platforms that claimed autonomous economic agency. Two of them executed agent decisions on centralized servers while their documentation described decentralized execution. Roughly nine in ten of their claimed on-chain activities were off-chain simulations presented through an on-chain interface. The tokenomics were void because the agency they priced did not exist. That finding was about architecture. The finding I did not publish, because it was outside the engagement scope, was worse: in all three systems, the agent's authority to act was a static credential with no scope, no expiry, and no audience restriction.
The agent could do anything the credential could do, forever, for anyone.
This is the on-behalf-of problem, and it is not new. OAuth Token Exchange and the on-behalf-of flow have been a dense vulnerability zone for a decade, precisely because delegation is where audience binding gets hard. When Alice delegates to an agent, the token must assert three things simultaneously: that Alice authorized it, what specifically she authorized, and which resource the delegated token is valid against. Omit the third and the agent's token works everywhere Alice's does.
MCP accelerates this by making agent-to-tool connections cheap to build. Cheap to build means built by people who are not identity engineers. The result is a fleet of middleware components, each holding a delegated credential, each sitting in the same trust position as the OAuth2 Proxy above โ inside the boundary, endorsed by a token nobody validated.
Every agent middleware is a potential assertion-decoupling point, and the number of them is growing faster than the number of people who understand the failure mode.
The strategic consequence for the identity market is underappreciated. If agent identity becomes the primary integration layer โ if the agent, not the employee, is the subject of most authentication events โ then the lock-in point moves. Incumbent IAM vendors whose moat is directory integration and SSO configuration would find the new subject of authentication outside their control plane. Whoever standardizes agent delegation first owns the next decade of the identity layer. That is a larger strategic fact than any single CVE in this cluster, and it is buried in the source material under a bad statistic.
Contrarian: what the bulls got right
The reflexive read on this cluster is that federated identity is broken and the protocols are unfit. I do not accept that conclusion, and the people arguing the opposite are correct on three points.
First, disclosure worked. Eight advisories in three weeks is evidence of a functioning reporting pipeline, not a collapsing one. The alternative โ the same defects, undisclosed, in production โ is strictly worse. A dense cluster of published criticals means researchers found them and maintainers shipped. Both halves of that sentence are achievements.
Second, the protocol-is-broken framing lets implementers off the hook, and they should not be. A specification that says SHOULD does not forbid MUST. Any implementation team can enforce audience binding locally, can pin issuer keys, can reconcile assertion against local user state. The best-in-class implementations already do. The modal-verb argument explains why the ecosystem default is weak. It does not excuse an individual team that shipped a 9.8, and it does not excuse a customer that never asked.
Third โ and this is the point the crypto audience will not enjoy โ the industry casting stones at enterprise IAM has a worse identity stack of its own. Sign-In with Ethereum deployments routinely ship with nonce reuse, missing domain binding, and no expiry discipline. Session keys in account-abstraction wallets are frequently scoped to "everything" because scoping is hard and demos are due Friday. The decentralized identity narrative has spent years promising self-sovereign credentials while the actual production pattern is a bearer token in local storage. Enterprise IAM at least has a specification to violate. Much of on-chain authentication has neither.
Takeaway
The question is not whether your identity provider is secure. It is whether you can produce, on demand, the artifact that proves your assertion binding is enforced โ the config diff, the test case, the audit log showing a token with the wrong audience was rejected. Most organizations cannot. Most organizations have never been asked.
That is going to change. The regulatory direction is from after-the-fact liability toward mandatory pre-deployment baselines, because the alternative โ assigning breach responsibility between a vendor who shipped a permissive default and an operator who accepted it โ has no clean legal answer and regulators dislike unanswerable questions.
When the examiner asks for your configuration baseline, what exactly will you hand them?