TL;DR; This post explains a phishing technique for FIDO cross‑device (hybrid) authentication. An attacker can run an AitM proxy that shows a fake, OS‑like QR code prompt in the browser. The attack requires placing one or more Bluetooth beacons within the victim’s Bluetooth range. See Proof of Concept and Demo Video Housekeeping First of all, I want to make clear that I am 100% convinced of FIDO. That’s a game-changer when it comes to security!...
TL;DR; I found a bypass for the recently fixed vulnerability, CVE-2024-9956, in Mobile Safari. The original fix blocks FIDO:/ URIs from being navigable. I was able to bypass it with a specifically crafted deep link to the Shortcuts app that leverages the x-cancel and x-error query parameters to open arbitrary URLs when the shortcut isn’t successful. Apple fixed it due to my report on 29 July 2025. CVE-2024-9956 (February 2025) All major mobile browsers were found to be vulnerable, allowing FIDO:/ intents to be triggered by a page....
Conference Talk at MCTTP 2025 Topic: Secure your Identity In today’s digital landscape, robust identity management is crucial for ensuring security and efficiency for companies. In this session the journey of a DAX30 company will be shared how the identity space was changed to address modern threats and risks. For large multinationals with a legacy history this becomes a real challenge. We will share some insights of a comprehensive architecture and technology stack that is detached from common SaaS IDPs and vendor agnostic....
TL;DR; EDIT 19.09.2025: Microsoft fixed it for normal Entra tenants, but still possible for federated Entra tenants. This is a novel technique that leverages the well-known Device Code phishing approach. It dynamically initiates the flow as soon as the victim opens the phishing link and instantly redirects them to the authentication page. A headless browser automates this by directly entering the generated Device Code into the webpage behind the scenes. This defeats the 10-minute token validity limitation and eliminates the need for the victim to manually perform these steps, elevating the efficiency of the attack to a new level....
Summary I discovered a vulnerability in Envoy Gateway, which allowed attackers to manipulate access logs via malicious User-Agent string. By injecting payloads into the User-Agent Header, attackers could overwrite log fields (e.g., spoof IP addresses) or crash observability tools by corrupting log formats. After discovering this CVE-2025-25294, I responsibly disclosed it to the maintainers and also fixed the code via that Commit. Impact In all Envoy Gateway versions prior to 1....