ATO 2 The Silent Bug: Response Manipulation, the Server Lied, the Client Believed, and Authentication Broke Sep 20, 2026 Insecure Design - BreakTheFlask Jun 5, 2025