SANS StormCast Highlights PowerShell Scripts for Azure AD Security, Critical Keycloak Vulnerability, and LLM Bypass Techniques

The August 21, 2026, SANS Internet Storm Center StormCast, presented by Johannes Ullrich from Jacksonville, Florida, highlighted two PowerShell scripts for Microsoft Graph automation to manage Entra (Azure AD) security. The first script identifies stale user accounts—those inactive for extended periods—and lists their assigned licenses, while the second collects users flagged by Entra’s risk detection system, detailing reasons like unusual browsers, geographic origins, or ASN-based anomalies. Keycloak version 26.7.2 was released to fix a critical password reset vulnerability allowing unauthenticated attackers to spoof verification tokens and reset any user’s password without email access. A blog post demonstrated 'cryptographic context injection,' a technique to bypass LLM guardrails by encrypting malicious requests, decrypting them only after the initial security filter. N-able’s Passportal password manager was patched for a cross-origin messaging flaw where improper origin checks enabled any website to extract stored passwords, posing a severe risk to managed service providers. The vulnerabilities underscore the importance of input validation after data transformation and secure cross-window communication in browser extensions.