On September 2, 2026, Dropbox disclosed that an attacker accessed roughly 5,000 accounts by abusing a flaw in Lenovo’s email-verification process to register fraudulent Lenovo IDs — never needing the victim’s Dropbox password. Audit every identity-federation link you accept and require re-authentication on SSO sign-ins.
Two authentication flaws in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, exploited since mid-August 2026, let an unauthenticated visitor become an administrator. The six paid editions never received a public advisory, so no vulnerability scanner could detect them.
On August 9, 2026 Planka shipped version 2.2.0, which removes OIDC/SSO from the community edition and deactivates the accounts that depended on it. Before you upgrade, create a local admin account or you risk locking yourself out of your own instance.
Authentik has become the default identity provider for self-hosters in 2026, surpassing both Authelia and Keycloak. One Docker Compose file, five minutes of configuration, and every service you run shares the same login, the same MFA, and the same user directory.
