response manipulation 1 The Silent Bug: Response Manipulation, the Server Lied, the Client Believed, and Authentication Broke Sep 20, 2026