You won't believe you don't need to see those horrible ads on the web

Published: Aug 14 2026

This #1 trick ad companies don't want you to know!

Risk of reflected cross site scripting and Content-Security-Policy bypass in the WebSub intent verification

Published: Jun 3 2026

I was reading the WebSub specification (formerly PubSubHubbub) when I found that there was a risk of reflected browser-side code injection (reflected cross site scripting, reflected XSS) in the WebSub intent verification exchange.

Authority Ambiguity Vulnerabilities in NGINX and Debian’s proxy_params

Friends don't let friends use $http_host

Published: May 28 2026

Two related authority-ambiguity vulnerabilities in NGINX and Debian's proxy_params configuration snippet.

Keycloak UMA vulnerabilities

Published: Jul 8 2025

Keycloak's UMA implementation seems tricky to me.

Malicious authorization server attack in UMA 2.0

Published: Mar 18 2025

In a previous post, I described a pass-the-permission-ticket vulnerability in UMA 2.0 in which a malicious UMA resource server could kindly ask a UMA client to give it access tokens actually intended for another UMA resource server. In this post, I am describing a similar attack when the authorization server is malicious.

Pass-the-permission-ticket vulnerability in UMA 2.0

Published: Mar 18 2025

In the User-Managed Access (UMA) 2.0 protocol, a malicious resource server (or a malicious server acting as a resource server) can obtain a requesting party (access) token (RPT) intended for another UMA resource server from a UMA client by passing a permission ticket obtained from the target resource server to the UMA client. This can compromise the privacy (confidentiality) and integrity of UMA protected resources.