https://215cd2c3.blog-8x6.pages.dev/tags/identity/Recent content in Identity on LiniomHugoenMon, 24 Aug 2026 11:19:40 +0200https://215cd2c3.blog-8x6.pages.dev/posts/identity-crisis/Mon, 24 Aug 2026 11:19:40 +0200https://215cd2c3.blog-8x6.pages.dev/posts/identity-crisis/<div class="paragraph"> <p>SSO vulnerabilities are often caused by something visibly broken. The application does not validate the token signature, accepts the wrong issuer, forgets <code>state</code>, or leaves an open redirect in the callback.<br/> <br/> This one is a bit more annoying.<br/> <br/> The token can be valid. The signature can be correct. The issuer and audience can match. The email can even be marked as verified.<br/> <br/> And the application can still log the attacker into the wrong account.</p> </div>