DPoP Authenticator
Summary: PortSwigger's BApp Store lists a Burp extension called DPoP Authenticator, authored by Serhat Cicek at version 1.0, that dynamically adds or updates the DPoP (Demonstrating Proof of Possession) HTTP header on outgoing requests based on configured criteria. The listing was last updated 16 January 2026, and PortSwigger states that extensions are written by third-party users of Burp and come with no warranty as to quality or usefulness.
Bottom line: DPoP is a control meant to bind tokens to a client's own key, and a tool that injects those headers into arbitrary outgoing requests gives testers a direct way to probe whether your implementation actually enforces that binding. The extension is third-party code with no warranty from PortSwigger, so anyone installing it is trusting an outside author inside their testing environment.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026