Oblique Security CTO Eric Chan uncovered vulnerabilities across 16 open-source SAML-based projects in just a month of evening experiments. To automate the code analysis, he deployed Claude Opus via a $200 subscription through the Anthropic Cyber Verification Program. The outcome of his part-time research includes four critical authentication bypasses, notably CVE-2026-57580 in the widely used enterprise single sign-on platform Authentik.
What stands out is not just the presence of the bug, but the unprecedented speed of discovery: Authentik developers received near-simultaneous vulnerability reports from eight independent researchers. The attack vector is a classic one: an XML comment injection in the NameID field allowed attackers to link an unauthorized account to a victim profile while preserving a valid cryptographic signature. As Chan dryly noted, this sudden cluster of discoveries has a simple explanation: everyone started scanning codebases with AI at the exact same time.
While the Go ecosystem has already pushed patches, similar Python and Node libraries still harbor unpatched denial-of-service vulnerabilities triggered by unauthenticated POST requests. For enterprises, this creates an immediate threat of corporate account takeover: while open-source maintainers struggle through backlogs, automated AI scanners costing pennies can map and exploit enterprise perimeters far faster than security teams can ship fixes.