freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CitrixADC-CVE-2020-8300

Detect Citrix ADC SAML action or SAML iDP Profile config vulnerable to CVE-2020-8300 using Citrix ADC NITRO API EXAMPLE & '.\CitrixADC-CVE-2020-8300.ps1' -NSIPProtocol http -NSIP 10.10.10.10 -user nitro -pass "SshhhItsASecret" If this proves useful to anyone I will develop further with the...

CVE-2026-8451

🚨 CVE-2026-8451 - NetScaler SAML IdP Memory Overread Vulnerability A pre-authentication memory disclosure vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway configured as a SAML Identity Provider IdP. ✨ Overview CVE-2026-8451 is a High-Severity memory disclosure vulnerability caus...

vcenter_saml_login

vCenter SAML 登录工具 一款用于从 vCenter 备份中提取身份提供程序（IdP）证书并以 Administrator 身份登录的工具 背景 通常在渗透测试任务中，我们会通过近期披露的 CVE 获得文件服务器上 vCenter 备份的访问权限，或获得 VCSA 主机的 root 权限。登录 vCenter vSphere UI 可以让我们轻松访问更多系统、获取机密信息，并向客户展示这些发现的影响。 data.mdb 文件包含这些证书，可在 vCenter 备份中找到，也可在具有 root 权限的 VCSA 主机上找到。这些证书以明文存储，可用于为任何用户（包括内置的...

CVE-2026-78425

Authorised users of outside applications behind the same corporate identity provider IdP, for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is...

CVE-2026-78425 SAML Audience Confusion Allows Cross-SP Authentication

Authorised users of outside applications behind the same corporate identity provider IdP, for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is...

CVE-2026-3055---Citrix-NetScaler-Memory-Overread-PoC

🔓 CVE-2026-3055 - Citrix NetScaler Memory Overread Exploit ⚠️ WARNING This tool is for educational purposes and authorized testing only. Do not use on systems without explicit permission. 📋 Description Exploit for CVE-2026-3055 - out-of-bounds read memory overread vulnerability in NetScaler ADC an...

CVE-2026-3055

CVE-2026-3055 - Vulnerabilidad de Seguridad Severidad: N/A CVSS: N/A Impacto: N/A Publicado: 2026-03-23 Legal Solo para pruebas de seguridad autorizadas. Causa raíz versión corta Validación de entrada insuficiente en NetScaler ADC y NetScaler Gateway cuando se configura como SAML IDP, lo que...

GO-2026-6469 ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider in github.com/zitadel/zitadel

ZITADEL: Missing Token Expiration exp Validation in JWT IdP Provider in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

check-cve-2026-3055-netscaler

Comprobación de CVE-2026-3055 en SAML IdP de NetScaler Helper en Python para sondear appliances Citrix NetScaler / NetScaler Gateway en busca de CVE-2026-3055 sobrelectura de memoria al actuar como proveedor de identidad SAML. La lógica de detección coincide con el informe público de watchTowr...

EUVD-2026-80069

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user...

CVE-2026-15640

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user...

CVE-2026-15640

CVE-2026-15640 affects Delinea Secret Server , a secrets management product. Under certain conditions, a valid SAML Identity Provider (IdP) response can be manipulated to impersonate another Secret Server user , effectively bypassing authentication. The vulnerability is rated CVSS 4.0: 9.5 (Criti...

PT-2026-93223

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user...

ZITADEL: Auto-linking by email: IdP-side email verification is not checked

Summary A flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user's email is verified, but does not explicitly cross-check whether the incomi...

GHSA-V77H-2W3M-94HX ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider IdP implementation Specifically, within the validation pipeline, if an incoming JWT omits the exp claim entirely, the expiration block is silently skipped rather than rejected. The token ...

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider IdP implementation Specifically, within the validation pipeline, if an incoming JWT omits the exp claim entirely, the expiration block is silently skipped rather than rejected. The token ...

CVE-2026-87853

A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf function compares the OIDC subject identifier using strncmp with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix...

DEBIAN-CVE-2026-87853

A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf function compares the OIDC subject identifier using strncmp with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix...

UBUNTU-CVE-2026-87853

A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf function compares the OIDC subject identifier using strncmp with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix...