EUVD-2022-1220

🗓️ 03 Oct 2025 20:07:09Reported by EUVDType

Fleet before version 3.5.1 is vulnerable to SAML response tampering allowing unverified logins.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2020-26276	17 Dec 202022:43	–	circl
CNNVD	Fleet Authorization Issues Vulnerability	17 Dec 202000:00	–	cnnvd
CVE	CVE-2020-26276	17 Dec 202019:40	–	cve
Cvelist	CVE-2020-26276 SAML authentication vulnerability in Fleet	17 Dec 202019:40	–	cvelist
Github Security Blog	SAML authentication vulnerability due to stdlib XML parsing	11 Feb 202223:59	–	github
NVD	CVE-2020-26276	17 Dec 202020:15	–	nvd
OSV	GHSA-W3WF-CFX3-6GCX SAML authentication vulnerability due to stdlib XML parsing	11 Feb 202223:59	–	osv
Prion	Authentication flaw	17 Dec 202020:15	–	prion
RedhatCVE	CVE-2020-26276	5 Feb 202513:38	–	redhatcve
UbuntuCve	CVE-2020-26276	17 Dec 202020:15	–	ubuntucve

[
  {
    "enisaIdVendor": [
      {
        "id": "b885aa52-3793-3454-96cd-3e6b5d346a15",
        "vendor": {
          "name": "fleetdm"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "62921695-3fba-3143-a7bf-0641404a6324",
        "product": {
          "name": "Fleet"
        },
        "product_version": "< 3.5.1"
      }
    ]
  }
]

Source	Link
github	www.github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-26276
github	www.github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607
github	www.github.com/fleetdm/fleet/blob/master/CHANGELOG.md
github	www.github.com/mattermost/xml-roundtrip-validator
mattermost	www.mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities

03 Oct 2025 20:07Current

9.1High risk

Vulners AI Score9.1

CVSS 3.19.8 - 10

CVSS 26.8

EPSS0.00978