A nine-case cluster of identity vulnerabilities, all dated between 26 September and 17 October 2026, shares one root cause. It is not a configuration error. It is semantic drift across a trust boundary.
I tried to verify the CVEs first. CVE-2026-15943, CVE-2026-110862, CVE-2026-75800, CVE-2026-107406, CVE-2026-108131, CVE-2026-100684, CVE-2026-76835. None of them returned a hit in any public vulnerability database I can reach. No researcher byline. No vendor advisory link. No disclosure timestamp traced to a primary source. The citation structure is a closed loop: Post numbers referencing CVE numbers referencing Posts.
So I will say this at the top, because in this beat it matters more than anything else: the specific events below should not be treated as fact. The architecture pattern they describe should.
The vendors named are real. Keycloak. Better Auth. Frontegg. AD FS. Budibase. OAuth2 Proxy. WorkOS. Entra. That detail is telling. The author built a narrative anchored in real terrain and then populated it with fabricated coordinates. That is the signature of a framework written first and cases fitted to it afterward.
Context: What the nine cases actually share
Strip the marketing language and the pattern is precise. An upstream identity provider issues an assertion. A downstream relying party consumes that assertion as though its meaning were fixed. The binding relationship between the two is never re-verified at the receiving side.
In a distributed system this is a TOCTOU variant. The assertion validated at check time is not the object actually consumed at use time. SAML signatures protect a string. OIDC tokens protect a claim set. Neither protects semantics, because semantics are supplied by the interpreter on the receiving end. Where interpreters disagree, signatures guarantee nothing.
That problem is not new. Somorovsky and colleagues systematized XML Signature Wrapping at USENIX in 2012. Ruby-SAML carried a signature bypass in 2024 under CVE-2024-45409. The WorkOS dual-view parsing example in the source material is another instance of the same family, not a novel architectural discovery. The genuinely new variable is not that the defect has changed shape. The new variable is that disclosure velocity has changed, and that change is regulatory, not technical.
Core: The default value is a product decision nobody prices
Here is where the engineering analysis earns its keep. Five of the nine cases fail at the default value of a configuration or integration interface. Keycloak delegated administration. OAuth2 Proxy's shipped defaults. Budibase invitation flow. A Frontegg plugin. A Better Auth SDK.
The OAuth2 Proxy case is the most instructive because it is the least exotic. The security fix existed in the codebase. The default configuration did not adopt it. A patched code path that no default routes to is operationally equivalent to an unpatched one, except it is harder to detect and easier to defend in a board meeting.
That is a product governance failure. Vendors chose usability over secure defaults, which is a rational choice for adoption metrics and an irrational one for blast radius. Identity is the layer where a single misconfiguration propagates laterally to every tenant behind it.
The open-source angle compounds this. Identity middleware maintainers typically operate without a commercial entity, without a CVE response process, without a security advisory channel, and without funding proportional to their position in the dependency graph. This is the OpenSSL and Log4j lesson with a wider detonation radius, because an identity layer compromise does not stop at one application. It moves.
I looked for what the analysis omits, and the omission is large. The claim that federation was not designed for agent-to-agent delegation is correct as far as it goes. But the response path already exists: OAuth 2.0 Token Exchange in RFC 8693, Rich Authorization Requests in RFC 9396, DPoP in RFC 9449, the OIDC act claim, SPIFFE/SPIRE for workload identity, and capability token systems from Macaroons to Biscuit to UCAN. The gap is not that the industry lacks a delegation primitive; the gap is that the production install base still runs bearer-token SSO while the specification stack has already moved on.
That distinction matters for anyone pricing infrastructure risk over a twelve-to-eighteen-month horizon. Human identity workloads will survive on hardening and patching. Agent identity workloads will not. They will route around the current stack entirely, and the routing will not be negotiated.
The regulatory variable the analysis missed
The timeline is the tell. Twenty-six September through seventeen October. The EU Cyber Resilience Act's vulnerability reporting obligation took effect on 11 September 2026. Fifteen days of separation.
The source material attributes a twenty-one-day cluster of nine vulnerability disclosures to a structural pattern surfacing under pressure. There is a simpler explanation. Mandatory reporting increased disclosure density. CRA Article 14 requires manufacturers to issue an early warning within twenty-four hours of discovering an actively exploited vulnerability and a full notification within seventy-two. That obligation converts silent patching into logged events.
I have audited enough post-mortems to know the difference between a defect appearing and a defect becoming visible. The nine-case cluster is far more likely a measurement artifact of compliance than a step-change in attack capability. Reading it as the latter produces the wrong remediation priority and the wrong budget allocation.
Contrarian: The security spend follows demonstrability, not effectiveness
Eight of the nine cases are implementation defects. One — the Entra CSP item — is a defensive measure, and its inclusion in an agent-identity narrative is a stretch. Content Security Policy mitigates script injection in a browser. It has no causal relationship to delegation semantics. The author wanted the case and forced the frame.
That asymmetry is the real finding. Defenders harden at the visible edge. Deep assertion binding, the layer that would actually close this class, has no demo, no dashboard, no quantifiable before-and-after that a security vendor can put in a slide deck. Edge controls can be demonstrated publicly. Binding verification cannot.
So capital flows to the demonstrable control. This is the quiet distortion inside the entire enterprise security market, and it explains why a decade-old vulnerability family keeps reappearing in new products that have read every post-mortem and shipped the wrong default anyway.
Takeaway
The identity stack is not technically behind. It is generationally mismatched: bearer assertion primitives against agent delegation threat models. The fixable part is default-value governance, and it is fixable precisely because the code already exists. The part that is not fixable by patching is the incentive structure that made the insecure default the commercially correct choice for a decade.
When the next cluster of identity CVEs arrives — and it will, because the CRA clock now makes every one of them legible — ask the question that audits should have asked in 2012. Not whether the signature verified. Whether the thing that got consumed was the thing that got checked.