PKCE Downgrade Flaws in OAuth Servers Let Attackers Hijack Authorization Codes

·1 views

Two CVEs filed six months apart — CVE-2023-48228 and CVE-2024-23647 — exposed the same critical flaw in the authentik identity provider, where the server accepted OAuth flows both with and without PKCE enforcement. PKCE (Proof Key for Code Exchange) is designed to bind an authorization code to a client-generated secret, preventing interception attacks on public clients like mobile apps and single-page applications. When servers treat the code_challenge parameter as optional, attackers can strip it from authorization requests, obtain an unbound code, and exchange it at the token endpoint without any verifier. A third vulnerability, CVE-2026-48717 in OpenAM, similarly left PKCE enforcement disabled by default via a realm-wide configuration setting. RFC 9700 mandates enforcement at both the authorization and token endpoints, yet most servers continue to ship with enforcement turned off.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Smart RAG Systems Must Learn When to Skip Retrieval Entirely

A growing challenge in production RAG (Retrieval-Augmented Generation) systems is not poor retrieval quality but the failure to decide when retrieval should not happen at all. Engineers at DEV Community highlight that blindly retrieving documents for every query adds latency, cost, and context noise while often producing confidently wrong answers. For example, a query about a live order status should route to an API tool, not a static policy document. Experts recommend building a routing layer that can choose between direct answers, tool calls, RAG retrieval, clarification requests, or refusals based on question type. Teams are also urged to treat retrieval similarity scores as evidence thresholds rather than truth signals, and to evaluate whether retrieval was even necessary — not just whether the final answer appeared correct.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS Agent Toolkit Brings Curated Cloud Knowledge and API Access to Coding Agents

AWS has released an Agent Toolkit that equips AI coding agents like Claude Code with curated AWS service knowledge and the ability to call AWS APIs directly. The toolkit consists of two independent components: locally stored Agent Skills, which guide service selection and troubleshooting, and an AWS-managed MCP Server that enables live API calls and documentation searches. Setup requires a single command, but users must have AWS CLI 2.35 or later, the uv package manager, and Node.js v22 or above installed beforehand. A notable configuration requirement is specifying the us-east-1 region, as the toolkit is only served from that region and the setup wizard will fail silently without it. The skills are open source under the Apache-2.0 license and are designed to enforce verification of current data rather than relying on the agent's potentially outdated internal knowledge.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

RAG, Memory, or Tools: A Framework for What AI Agents Should Actually Store

A technical guide published on DEV Community breaks down a common architectural challenge in building production AI agents: deciding where different types of information should live. The piece argues that the core mistake is not choosing between RAG, memory, or tools, but blurring their distinct roles together. According to the framework, tools should handle live system state, RAG should serve large read-only knowledge bases, and memory should store durable, scoped user facts across sessions. The context window is recommended only for temporary working state, while raw conversation logs should not be treated as memory without a clear retrieval and privacy plan. The overall guidance stresses that agents should store less than teams typically assume, but whatever is stored must be deliberate, scoped, and set to expire when no longer accurate.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI-Generated n8n Workflows Need Structured Review Pipelines, Not Just Human Eyes

AI tools can now generate n8n automation workflows quickly, but their speed and ease of creation introduce serious operational risks that manual review alone cannot catch. A workflow produced by an AI may run successfully while silently performing unintended actions, such as exposing sensitive data, using over-privileged credentials, or triggering costly API loops. Experts argue that AI-generated workflows should be treated as untrusted executable code rather than harmless suggestions, since they can directly interact with production systems, databases, and third-party services. A reliable review process should combine automated linting, policy checks, execution manifests, and runtime gates alongside human approval, rather than depending on a single reviewer. The core argument is that the reviewer should be a structured pipeline — not an individual — to handle the volume and complexity that AI-assisted workflow generation introduces.

0 comments Read more at DEV Community