October 11, 2026
- Tenable disclosed a session-takeover flaw in the Hermes Agent sign-in flow (versions before 0.21.6): a parser disagreement, where Python treated a crafted redirect URI as loopback while the browser interpreted it differently, leaked the login code after the victim signed in. Because the attacker controlled the PKCE challenge, the stolen code could be exchanged for session tokens. Fix merged 1 October, 0.21.6 released 8 October. Tenable Research · Vulnerabilities & Exploits
in Microsoft's 17 Trillion-Row Analytics Service Fell to One Unchecked JWT