Authentication & MFA
Most SaaS apps cannot locally mandate phishing-resistant MFA
A study of 95 SaaS apps reveals most cannot locally mandate passkeys, forcing firms to rely on identity providers and expensive enterprise plans.
MFA Bypass & Token Spraying
Attackers are increasingly sidestepping multi-factor authentication rather than breaking it, through token spraying, session replay and exploited appliance flaws. This hub tracks the techniques, the victims and the countermeasures vendors and defenders propose.
Understand the story
Follow this story through dated reporting and the underlying records. Evidence labels distinguish documented findings, attributed reporting, disputed accounts and claims that remain unverified. Start with the background reports below, then read the latest developments.
Start with these reports
Latest reporting
More on MFA Bypass & Token Spraying
Flaws & Advisories
SonicWall warns of SSLVPN flaw that bypasses MFA
SonicWall urges prompt upgrades to fix a vulnerability potentially exploited in the wild, while CERT/CC discloses separate flaws in Logto authentication.
Flaws & Advisories
Cisco warns of exploited zero-day authentication bypass in ISE
The CVE-2026-76460 vulnerability carries a CVSS 10.0 score and allows remote attackers to bypass the web-based management interface of the policy platform.
Incidents & Breaches
Attacker bypasses MFA at 79 organizations using token spraying
An attacker used "token spraying" to bypass MFA at 79 organizations, registering rogue devices and replacing MFA methods to survive password resets.
Flaws & Advisories
Cisco warns of exploited authentication bypass in SD-WAN Manager
A critical flaw in Catalyst SD-WAN Manager allows unauthenticated admin access, while NinjaOne implements a controlled bypass to reduce SSO friction.
Authentication & MFA
FIDO2 passkeys block session token theft
Organizations are shifting to phishing-resistant passkeys as attackers use reverse proxies to steal session tokens and bypass traditional MFA in Microsoft 365 environment...
Incidents & Breaches
Attackers bypass MFA at 79 organizations using session token replay
Threat actors used stolen sign-in sessions to breach Microsoft 365 accounts, while a new report finds identity systems targeted in 87% of ransomware cases.
Authentication & MFA
Passkey adoption grows as Google fights session theft
Passkeys now account for 36% of successful sign-ins across 15 consumer services, while Google expands cookie protections for Windows Chrome users.
Timeline 6 reports
- 2026
- Attackers bypass MFA at 79 organizations using session token replay
- FIDO2 passkeys block session token theft
- Cisco warns of exploited authentication bypass in SD-WAN Manager
- Attacker bypasses MFA at 79 organizations using token spraying
- Cisco warns of exploited zero-day authentication bypass in ISE
- Most SaaS apps cannot locally mandate phishing-resistant MFA