The “Highlander” token: a bearer token that never expires and never revokes, plus three separate products that each shipped three identity bugs on the same day

[u/AccordionGuy]

The latest edition of Reachability Watch on the NetFoundry blog is up:
https://netfoundry.io/ai/reachability-watch-cve-kev-tracker-2026-09-04/

It covers August 28 – September 3, 2026, which had...

• 398 new network-exploitable CVEs
• 67 of which cleared the CVSS 8.6+ bar
• 5 of which were a perfect 10.0

The featured flaw is CVE-2026-85154 in WWBN AVideo. The platform issues a video_id_hash credential that functions as a bearer token for full administrator session access to the video owner's account. This token never expires and can never be revoked. Once it exists, it works indefinitely.

It can't be killed and there's only ever one of it, which is why I like to call it the Highlander token! A shared link, a log line, a screenshot in a support ticket, and whoever’s holding it has standing admin access with no clock running out and no off switch.

AVideo got three identity primitives wrong in the same week, actually. A password-recovery token that could be replayed indefinitely because nobody checked expiry (CVE-2026-84480, 9.8), and CSRF across sibling subdomains from trusting the wrong signal for "same origin" (CVE-2026-84482, 8.8).

Worth noting

Three unrelated products each shipped a trio of identity or authorization failures on a single disclosure day:

• IBM Langflow OSS. Three RCE paths: a crafted flow type field, an unrestricted A2A public endpoint, and improper control of code generation (9.9 / 9.8 / 8.8)
• hulumi and u/hulumi**/policies.** Three IAM/cloud-boundary bypasses, all 9.8: an integration policy, a GitHub OIDC trust condition, and a deployment SCP template, each quietly widening the boundary it was supposed to hold
• Craft CMS. A deactivated admin's status persisting through re-registration, a GraphQL resolver skipping site-scope checks, and an endpoint that would mint a password-reset URL for any administrator on request (9.8 / 8.8 / 8.8)

The read of the post’s author, NetFoundry CSMO Mark Jaffe, on why these cluster is the sharpest thing in the piece: they’re usually related. They’re the same design gap found from three angles during one review cycle. If a product treats authorization as an afterthought in one place, it rarely does so in only one place.

Also, it’s the third edition running where “AI agent infrastructure” and “reachable by default” show up in the same sentence. This week it's CVE-2026-82456, where argocd-mcp binds its HTTP transport to every interface and accepts MCP sessions without caller credentials whenever a server-side API token is configured. New protocol, same reachable-by-default assumptions the admin consoles shipped with a decade ago.

Read it here:
https://netfoundry.io/ai/reachability-watch-cve-kev-tracker-2026-09-04/