Topic
An arrangement where one authentication session, held by a shared identity provider, logs a user into multiple separate applications.
Scammers posing as Hollyland are sending YouTube creators tailored sponsorship offers that end at a fake Google login, WeLiveSecurity reported. That page takes the password and the one-time code, and with them the account that owns the channel.
Reality
UK education software supplier Bromcom says unauthorized access to a legacy SSO registration feature exposed users' email addresses and reference numbers. Its school records system was not reached, so the question for schools is which older login features suppliers still run.
Reality
Patchstack says attackers are chaining CVE-2026-61979 and CVE-2026-15981 to mint WordPress admin sessions. Only the free edition got an advisory; Standard needs 17.0.6.
Perspective Coverage
5 publishersReality
Brevo says an intruder reached 120 customer accounts and used them to mail phishing from those customers' own domains. Three crypto companies confirmed their newsletter lists were hit. Only one named the provider.
Perspective Coverage
4 publishersReality
SAML's security rests on XML signature validation, and most fielded implementations hand that job to libxmlsec. Trail of Bits says that dependency is the reason to deprecate the protocol and move SSO to OpenID Connect.
Reality
GitHub Enterprise Cloud lets an admin clear SSO authorizations for personal access tokens, SSH keys and app user tokens across every organization at once, while deleting the credentials themselves stays limited to Enterprise Managed Users.
Reality
Dashlane's answer to employees drifting back to typed passwords is a per-domain block inside the browser extension. The work that decides whether it helps happens upstream, when an admin picks which login pages go on the list.
Reality
Fortinet switched off FortiCloud SSO worldwide on January 26 and turned it back on the next day with server-side changes. Devices already fully patched against the two 2025 SAML bypasses were compromised anyway.
Reality
ANY.RUN says the kit lures staff with Teams, DocuSign and Dropbox pages, walks them through a genuine device code sign-in, and then takes the access and refresh tokens to register a device of its own.
Reality
EarthLink Network's in-house identity platform now settles administrator status in one function, on both token issue and refresh, using the group-name check its products were already applying, and the UI only displays the answer.
Reality