Nine identity infrastructure failures in twenty-one days. That is the shape of the story that landed in my inbox last month, dressed as a revelation, framed as a new paradigm, and accompanied by a CVE list I could not verify against a single public database. My first instinct, the instinct that eighteen years of reading code before reading press releases has burned into me, was to throw it out. My second instinct was to read the mechanics anyway, because a false story told with accurate architecture is still a true story about architecture.
Here is what the report claimed. Between late September and mid-October, a cluster of gaps surfaced across the identity stack: Keycloak delegated administration, OAuth2 Proxy default configuration, Budibase invitation flows, a Frontegg plugin, a Better Auth SDK, AD FS, WorkOS, Citrix patch metadata, and an Entra CSP misconfiguration. The narrative wrapped these into a thesis about trust boundaries collapsing. The dates were in the future. The CVE numbers did not resolve. Every vendor named is real, which tells me the author knew the terrain and built the story on top of it, framework first, evidence second.
So let me be precise about what I am doing here. I am not validating those nine cases. I am taking the mechanism they describe and stress-testing it against twenty years of identity protocol history, because that mechanism has a name, and the name is older than the article's authors appear to know.
The shared root cause, stated cleanly: a cross-trust-domain semantic drift combined with a missing binding verification. An upstream authority signs an assertion. A downstream consumer reads that assertion and treats it as if it means what the upstream meant. It does not. It means what the downstream interpreter decides it means. And if there are two interpreters between them, the signature protects the string, not the meaning.
This is a TOCTOU variant. Time-of-check to time-of-use. The assertion you validated is not the same object as the assertion you consumed. In a single-process system with a single parser, you can enforce single-parse discipline and the problem disappears. Across SAML, OIDC, XML, JSON, proxied headers, and three generations of middleware written by people who never met each other, you cannot. I watched this exact failure mode in 2017 while auditing shielded pool transaction handling on Zcash's Sapling work, where private transaction malleability allowed a value to be interpreted one way at proof time and another way at settlement time. Different domain. Identical physics.
Now the part the source material got structurally wrong, and this matters more than any single case.
The article frames XML signature wrapping as a new frontier. It is not. Somorovsky and colleagues systematized the entire family at USENIX in 2012. Ruby-SAML had a signature bypass in 2024, CVE-2024-45409, which is the same attack with a different year stamped on it. SAML's AudienceRestriction, OIDC's azp, nonce, and state parameters, every one of them is a post-hoc patch bolted onto a protocol that assumed a benign interpreter. The pattern is not new. What changed is velocity.
And that brings me to the single most important variable missing from the entire analysis, the one I would bet the authors simply did not have the regulatory calendar in front of them for.
The timeline. September 26 to October 17, 2026. The EU Cyber Resilience Act's vulnerability reporting obligations under Article 14 take effect September 11, 2026. Fifteen days before the first case in the cluster. Twenty-four-hour early warning for actively exploited vulnerabilities, seventy-two-hour notification. Manufacturers lose the option of silence.
The simplest explanation for nine disclosures in twenty-one days is not that the stack suddenly got worse. It is that the disclosure channel suddenly got mandatory.
I have seen this movie from the inside. In the 2021 NFT cycle I spent weeks optimizing ERC-721A assembly for a high-frequency mint bot and abandoned it, because the gas profile made the utility case negative. Nothing about the contract language changed that year. What changed was that everyone was suddenly reading the same bytecode and publishing what they found. Discovery density tracks attention and incentive, not underlying defect count. When the CRA flips the incentive from concealment to statutory reporting, the measured rate of identity failures rises even if the true rate is flat. Any analyst who reads a disclosure spike as a security regression without controlling for the reporting regime is doing astrology with timestamps.
What the report also missed is that the defensive side of this fight is asymmetric in a way that is almost perfectly designed to misallocate capital. Eight of the nine examples are implementation defects. One, the Entra CSP item, is a defensive measure, and it is the one that gets written up. Ask yourself why. Because a CSP header is demonstrable. You can screenshot it. You can put it in a vendor deck. A binding verification check layered into a SAML consumer deep in your middleware has no screenshot. It has no dashboard. Its success state is an absence of incident, which is indistinguishable from luck until the day it is not.
Security investment is driven by demonstrability, not by effectiveness. That is not a cynical observation, it is a budget line item. It is why the OAuth2 Proxy case deserves more attention than any of the exotic ones: the fix already existed in the codebase, and the default was left permissive. Not an unknown vulnerability. A known one, shipped as the default, because changing it would have broken integrations and generated tickets. That is a product governance failure with a CVE attached, and it is more dangerous than a zero-day because it is permanent.
Which brings me to the real generational problem, the one lurking under all nine cases and only half-articulated in the source.
The identity stack was built for humans. Human SSO is essentially a one-time authorization followed by a long-lived bearer token. Holder equals authority. That model was already strained by machine-to-machine workloads. It breaks structurally under agent delegation, where what you need is a chain of delegated authority, monotonically decreasing scope, and verifiable provenance for every hop. The article gestures at this and then stops at describing the problem.
It never mentions OAuth 2.0 Token Exchange, RFC 8693. Never mentions Rich Authorization Requests, RFC 9396. Never mentions DPoP, RFC 9449, or the OIDC act claim, or SPIFFE and SPIRE for workload identity, or capability token systems like Macaroons and Biscuit and UCAN. These are not speculative. They exist, they are specified, and they are the only realistic path out of bearer-token semantics for non-human principals. An analysis of agent identity that does not engage with the delegation primitives already standardized is not analyzing the problem. It is describing it.
That gap is also the opportunity. Every organization moving agent workloads into production over the next eighteen months will hit the bearer token ceiling. The ones that solve it will not do so by hardening their human SSO. They will do it by running a parallel authorization plane for machines, with capability tokens and attenuation at every hop, while the human plane stays boring and unchanged. The human identity stack does not need to be replaced. It needs to be separated from the non-human one, urgently, before agent traffic shows up on the same rails as employee logins.
The Contrarian read, and this is where most retail interpretation of identity risk goes wrong: the danger is not in your IdP. Keycloak, Entra, AD FS, WorkOS are largely doing what they were specified to do. The danger is in the seam between your IdP and the third-party application that consumes its assertions, because that seam is where the interpreter is different, the parser is different, and nobody owns the binding check. Vendor hardening improves the thing that was already the strongest link. Meanwhile the CIAM integration written by a contractor four years ago, using a middleware library that has since gone unmaintained, sits in the path of every login and has never been independently reviewed.
I have paid this tuition in cash. In May 2022, watching UST liquidity drain in real time, I cut positions and took a sixty percent loss to preserve the remainder. The lesson was not about Terra's mechanism. The lesson was that exit capability is the only risk control that matters when the surface turns. Apply it here. When the CRA raises disclosure pressure across the identity ecosystem, the organizations that survive the next wave of published findings will not be the ones with the most security tooling. They will be the ones who can enumerate every place an assertion is consumed and validated separately, and who can patch a middleware default on a weekend without a change advisory board.
What I would watch now, concretely: the delta between advisory volume and actual exploitation telemetry over the next two quarters. If disclosure rises and exploitation stays flat, the CRA hypothesis is confirmed and the ecosystem is healthier than the headline count suggests. If both rise together, we are looking at something real. And separately, watch whether any major CIAM vendor ships attenuated delegation primitives before the enterprise buyers start demanding them. The first one to ship capability-scoped agent tokens at the platform level controls the next procurement cycle, because they will be the only vendor whose architecture survives agent workloads at scale.
The puzzle nobody in that twenty-one-day report addressed: if the fix routinely exists in the code and merely fails to ship as the default, what exactly are we paying identity vendors for? Availability, or accountability? Check the chain, not the tweet. The default configuration is the product, and right now almost every vendor is selling you the version that breaches first and explains later.
