Security

Session-Based Authentication

An authentication scheme in which a user submits credentials to a login endpoint, the server establishes a session, and subsequent requests are tied to that session. The dedicated login path these schemes expose is a frequent target for authorization-bypass bugs, since reaching it or impersonating its result can grant authenticated access.

Deep dive

Learn Article

How an Encoding Mismatch Between Two Parsers Defeats an Access Rule

When the layer that checks a path and the layer that routes it decode a URL differently, one encoded character slips past authorization. The mechanism behind CVE-2026-76504 and how to close it.

intermediate 5 min read

Back to glossary