# Primary research and transfer limits

These short summaries are locally written. They describe published mechanisms, not current live
vulnerabilities or authorization to test the named products. Retrieve the current source/version when needed.

- **Zakhar Fedotkin, PortSwigger — [The Fragile Lock](https://portswigger.net/research/the-fragile-lock).**
  Signature validation and assertion processing used different interpretations of XML. The important
  question is whether the authenticated data is the data later trusted. Use this to compare parser and
  verification boundaries in an owned local setup, not to assume every SAML deployment is vulnerable.
- **Gareth Heyes, PortSwigger — [Splitting the email atom](https://portswigger.net/research/splitting-the-email-atom).**
  Email handling can differ between systems that use the same input for routing and trust decisions.
  Map those interpretations and prove any resulting authority change. An unusual address or parser
  difference alone is not an authentication bypass.
- **Simon Koeck — [DevSite session write-up](https://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce).**
  A large client-side session led to investigating serialized objects, key reuse and the consumer of
  authenticated data. The transferable method is the complete trust chain plus negative controls.
  Do not use an exposed production secret to reproduce or expand its reach.

Read on 2026-10-13. Original authors retain rights to their articles; full articles are not bundled.