SonicWall warns of an exploited VPN bypass flaw, according to security reports

SonicWall patches exploited VPN bypass

SonicWall released security updates for seven vulnerabilities in SonicOS firewalls ^[7]. One of these is an SSL-VPN authentication bypass flaw that attackers are currently exploiting ^[7].

Google proposes digital ID for recovery

Google is developing an account recovery method using signed digital identity credentials to replace weaker traditional procedures ^[6]. The company aims to prevent scenarios where lost phones force users toward recovery methods that undermine the security of passkeys ^[6].

Claire Forszt, Google product manager for authentication and account recovery, stated at Authenticate 2026 that "if a passkey can be recovered with a lower security bar than the passkey holds, then the security benefit essentially becomes moot" ^[6].

Under the proposed scheme, users register a digital identity credential in advance to generate a "stable hash" linked to their account ^[6]. If a user loses their device, they can obtain a new credential after verifying their identity with the issuing authority ^[6].

Google predicts digital IDs could account for 50% of all account recovery methods by 2035 ^[6]. However, the system faces hurdles including technical interoperability between digital wallets and operating systems, as well as the speed of credential issuance ^[6].

Keycloak SAML signature flaw

A vulnerability in Keycloak, tracked as CVE-2026-117691, allows attackers to bypass SAML HTTP-Redirect signature verification to impersonate federated users ^[5]. Red Hat assigned the flaw a CVSS v3.1 score of 9.1 ^[5].

The flaw stems from a mismatch in how Keycloak processes parameter names ^[5]. The system decodes percent-encoded names during message processing, but the signature-verification logic only recognizes literal names ^[5]. An attacker with their own account at an external identity provider can use this inconsistency to process a crafted unsigned message as if it were signed ^[5].

Keycloak released a fix in version 26.8.2 on November 5, 2026 ^[5]. CERT Santé reported on November 6 that while an open-source proof of concept exists, active exploitation has not been observed ^[5].

Session tokens bypass MFA controls

Technical reports from Vulnerability Mechanics indicate that stolen session tokens now allow attackers to bypass passwords and multi-factor authentication (MFA) ^[3]. Because MFA is a checkpoint at the login screen, it does not trigger when an attacker replays a token issued after a legitimate user has already authenticated ^[3].

Session hijacking is growing 127% year-over-year ^[3]. In 2024, analysts recovered more than 17 billion stolen cookie records from the dark web ^[3]. Common delivery methods include:

• Infostealer malware: Tools like Lumma, Vidar, and RedLine read cookies directly from browser storage ^[3].
• Browser-in-the-Middle: Attackers proxy sessions in real time to grab tokens after authentication ^[3].
• XSS-based theft: Malicious scripts ship cookies from the victim's browser to an attacker's server ^[3].

OAuth misconfigurations in SaaS

Misconfigured OAuth 2.0 flows are enabling account takeovers in SaaS environments ^[2]. A primary risk is the use of refresh tokens that never expire ^[2].

In March 2025, attackers breached Salesloft's GitHub environment and used non-expiring OAuth tokens tied to a Drift integration to reach Salesforce instances at over 700 organizations ^[2]. A similar compromise at Allianz Life exposed 1.1 million customer records ^[2].

Other risks include redirect URI validation failures ^[2]. If a server uses wildcard or path-prefix matching instead of exact-match comparisons, attackers can redirect authorization codes to their own domains ^[2].

What we don't know

• Which specific SonicOS versions are affected by the SSL-VPN bypass?
• Whether Red Hat has issued a supported remediation package for RHBK deployments regarding CVE-2026-117691.
• Which specific public-private partnerships Google requires to build social acceptance for digital ID recovery.