Authentication is where most novel work is not needed and where the most avoidable bugs still ship. Session pinning after login state changes, mixed-scope tokens that outlive the session that produced them, and cross-domain assumptions that break under a subdomain policy change are the three we surface most consistently.
The counter-intuitive lesson: it is almost always a review of session lifecycle transitions — not of the crypto — that finds the real issue.