Critical Citrix NetScaler Flaw CVE-2026-19490 Allows Authentication Bypass via SAML

·1 views

A critical vulnerability, CVE-2026-19490, has been identified in Citrix NetScaler ADC and NetScaler Gateway, carrying a CVSS v4.0 score of 9.3. The flaw stems from a logic error in the SAML HTTP-Redirect binding handler that fails to enforce signature verification, allowing attackers to submit unsigned assertions and obtain valid sessions without any credentials or cryptographic material. Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21, along with corresponding FIPS and NDcPP builds, while end-of-life branches 12.1 and 13.0 will not receive patches. Citrix published advisory CTX696939 on August 19, 2026, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 9, 2026. Because NetScaler operates as boundary infrastructure, a successful exploit could expose all resources behind the gateway, and the attack leaves no signature-failure log entries, making detection particularly difficult.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Two-Artifact Freeze Method Keeps AI Patch Reviews Scoped to Real Bugs

Open-source maintainers risk unintended API expansions when coding models generate overreaching diffs in response to bug reports. A proposed workflow requires freezing two artifacts before any model session begins: a git bisect SHA identifying the first bad commit, and a snapshot of existing public API names. These two files act as hard merge gates, restricting model edits strictly to files changed in the offending commit. The bisect must confirm a reproducible test failure before any chat session starts, and a flaky test halts the entire process. The method aims to prevent silent surface-area growth and keep code review focused on the actual defect rather than model-suggested additions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Excel at Exploratory Testing but Fall Short for Regression Suites

AI agents have proven effective for exploratory testing by dynamically navigating interfaces, reacting to unexpected states, and investigating bugs without fully predefined steps. However, regression testing demands repeatable, documented action sequences and consistent checks so that results across multiple runs can be meaningfully compared. When an agent adaptively chooses alternate paths or accepts different signals as proof of success, it undermines the comparability that regression testing requires. Experts argue teams should use AI agents for ambiguous, one-off, or investigative tasks while investing in structured test assets for workflows that must be verified before every release. The key question for testing teams is not whether to use agents or automation, but which work benefits from flexibility and which requires repeatability.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Postgres Advisory Locks Prevent Double-Counted Bids in Pay-to-Rank Apps

A developer behind Steal the Spot, a pay-to-rank leaderboard where every bid is real money, shared a concurrency-safe payment pattern built on Supabase Postgres and Dodo webhooks. The core problem addressed is duplicate webhook deliveries and simultaneous bids causing incorrect rankings or double-applied payments. The solution uses pg_advisory_xact_lock to serialize bids per season, an idempotency check that detects already-processed payment IDs, and a FOR UPDATE row lock to prevent interleaved rank calculations. The advisory lock's transaction-scoped variant ensures a crashed worker cannot permanently block the system. Access to the underlying database function is restricted to the service role, preventing clients from manipulating their own rank directly.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Learns Hard Lessons Adding Chinese to an AI-Powered Codenames Game

A developer who built an AI-powered Codenames web game added Simplified Chinese word sets after a reader requested multi-language support. AI tools generated candidate translations quickly, but evaluating whether they were natural or appropriately ambiguous still required human judgment. An automated validator that flagged substring overlaps as hard errors initially pushed translations toward unnatural single-character fragments and awkward abbreviations. Relaxing the rule so overlaps triggered review rather than build failures allowed more natural Chinese words to be used. The key insight was that automated validators can catch structural errors like duplicates, but product decisions about word meaning and naturalness require human oversight.

0 comments Read more at DEV Community