Blog · 2 posts
#oidc
- News · Oct 21, 2026GitLab patches a SAML-to-LDAP account takeover and OIDC discovery cache poisoning
GitLab's October 21 critical patch release fixes CVE-2026-15723, which let a signed-in user take over an LDAP-backed account when OmniAuth SAML and LDAP auto-linking are both on, plus OAuth/OIDC discovery cache poisoning and a SAML/LDAP membership lock gap.
- News · Oct 13, 2026SlugFest: npm trusted publishing trusted repository names, so reclaimed names could publish
Bloom Security found npm trusted publishing matched GitHub repositories by owner/name until first publish, letting anyone who reclaimed a renamed or deleted slug mint publish tokens for more than 1,500 packages. npm now expires unvalidated configurations after 48 hours.