nOAuth Abuse Alert: Full Account Takeover of Entra Cross-Tenant SaaS Applications

Follow-up nOAuth research: two of 38 newly tested SaaS apps were still vulnerable, one with permissions enabling a pivot back into Microsoft 365 — and why Semperis rates the risk severe.

SyncJacking: how attackers can abuse Entra Connect hard matching to take over synchronized Entra ID accounts, including Active Global Administrators — and how to detect and mitigate it.

The flaw can yield unauthenticated administrator takeover across four AD360-integrated ManageEngine products. Exploitation is targeted and timing-dependent, but the impact is critical.

CVE-2026-22557, a CVSS 10.0 path traversal in UniFi Network's guest portal, lets unauthenticated attackers read arbitrary files and controller backups holding admin credentials, enabling takeover.

CVE-2026-27886 is a Strapi 4.0.0–5.36.1 sanitization bypass that turns API responses into a one-bit oracle; attackers extract an admin's reset token character by character, then take over the account.

Bugcrowd pushes back on XSS-fatigue: over 25% of its submissions are XSS, and chained XSS plus CSRF attacks have enabled account takeover. Real cases and the updated VRT show XSS is still high impact.