Improvements to Burp Suite authenticated scanning

Summary: PortSwigger's Burp Suite 2021.9.1 added behind-the-scenes improvements to authenticated scanning, letting Burp Scanner record and replay login sequences inside iframes, wait for animated elements to finish before clicking, and handle JavaScript redirects to login pages. The release also fixed a bug where the scanner clicked a button's nested SVG image instead of the button itself, and added support for multi-select elements.
Bottom line: Authenticated scanning only works if the scanner can reliably replay a real login, and this release shows how many small mechanics - iframe frameId tracking, animation timing, SVG XPath identification - can break that replay and leave privileged areas of an application untested.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026