Lucene search
+L

1185 matches found

Kitploit
Kitploit
added 2026/09/17 11:53 a.m.32 views

shimit

shimit shimit is a python tool that implements the Golden SAML attack. More informations on this can be found in the following article on our blog. root@kitploit: python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY...

5.8AI score
SaveExploits0
BDU FSTEC
BDU FSTEC
added 2026/09/17 11:41 a.m.41 views

Blitz Identity Provider (Authentication server)

...

5.8AI score
SaveExploits0
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.38 views

Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery

The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery SSRF due to insufficient restriction of the requesturi parameter, which allows attackers to interact with arbitrary third-party HTTP services. id: CVE-2022-24129 info: name: Shibboleth OIDC O...

8.2CVSS7.7AI score0.06139EPSS
SaveExploits1References5
Kitploit
Kitploit
added 2026/09/16 6:38 p.m.15 views

authentik

什么是 authentik? authentik 是一个面向现代单点登录(SSO)的开源身份提供者(IdP)。它支持 SAML、OAuth2/OIDC、LDAP、RADIUS 等协议,专为自托管而设计,从小型实验室到大型生产集群均适用。 我们的企业版产品可供组织使用,以安全地替代 Okta、Auth0、Entra ID 和 Ping Identity 等现有 IdP,实现稳健的大规模身份管理。 安装 Docker Compose:推荐用于小型/测试环境。请参阅文档。 Kubernetes(Helm Chart):推荐用于较大型环境。请参阅文档和 Helm chart 的仓库。 AWS...

5.8AI score
SaveExploits0References6
Kitploit
Kitploit
added 2026/09/16 12:17 p.m.6 views

flask-saml2

flask-saml2 .. note:: 寻找维护者 。本项目已不再维护。该库在我上次使用时仍可正常工作, 但我已不再参与当初为其构建的项目。如果您有兴趣接管并维护此项目,请与我们联系。 .. image:: https://travis-ci.com/timheap/flask-saml2.svg?branch=master :target: https://travis-ci.com/timheap/flask-saml2 .. image:: https://badge.fury.io/py/flask-saml2.svg :target:...

5.9AI score
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/16 10:57 a.m.7 views

CVE-2023-34362

CVE-2023-34362 POC for CVE-2023-34362 affecting MOVEit Transfer Technical Analysis A technical root cause analysis of the vulnerability can be found on the blog: Summary This POC abuses an SQL injection to obtain a sysadmin API access token and then uses that access to abuse a deserialization cal...

9.8CVSS8.8AI score0.99934EPSS
SaveExploits15
Kitploit
Kitploit
added 2026/09/16 6:45 a.m.13 views

check-cve-2026-3055-netscaler

CVE-2026-3055 NetScaler SAML IdP check Python helper to probe Citrix NetScaler / NetScaler Gateway appliances for CVE-2026-3055 memory overread when acting as a SAML Identity Provider. Detection logic matches the public write-up from watchTowr Labs. Prerequisites Python 3.10+ Only applies to...

9.8CVSS8.7AI score0.87166EPSS
SaveExploits7
EUVD
EUVD
added 2026/09/16 12:31 a.m.10 views

EUVD-2026-80069

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user...

9.5CVSS5.7AI score0.00278EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/15 3:17 p.m.6 views

CVE-2026-49254

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc or RBAC, while manager/handlers/oauth.go returns models.Oauth records and...

6.3CVSS0.00276EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/09/12 12:31 a.m.11 views

EUVD-2026-76741

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

6CVSS5.7AI score0.00091EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/11 10:16 p.m.11 views

CVE-2026-90452

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

6CVSS0.00091EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/11 10:13 p.m.20 views

EUVD-2026-42966

ZITADEL: Auto-linking by email: IdP-side email verification is not checked...

4.8CVSS5.7AI score0.00285EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/11 9:51 p.m.19 views

CVE-2026-90452

CVE-2026-90452 affects a reverse proxy component where requests to an identity-provider service (for token discovery, introspection, and credential exchange) do not verify the IdP's server certificate . An attacker positioned on the network path between the proxy and the identity provider could i...

6CVSS5.7AI score0.00091EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/11 9:51 p.m.6 views

CVE-2026-90452

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

6CVSS5.8AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/09/11 9:51 p.m.31 views

CVE-2026-90452

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

6CVSS0.00091EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/09/11 12:00 a.m.12 views

PT-2026-90521

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

6CVSS5.7AI score0.00091EPSS
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/10 10:50 p.m.9 views

CVE-2026-3055

🔥 NetScalerBleed2: Critical Unauth Memory Overread in Citrix NetScaler CVE-2026-3055 Unauthenticated Out-of-Bounds Memory Read Memory Leak Only on appliances configured as SAML Identity Provider IdP 📋 Overview CVE-2026-3055 is a critical out-of-bounds read vulnerability CWE-125 in Citrix NetScale...

9.8CVSS8.8AI score0.87166EPSS
SaveExploits7
Veracode
Veracode
added 2026/09/10 2:03 p.m.5 views

Improper Input Validation

Apache CXF is vulnerable to Improper Input Validation. The vulnerability is due to failure to validate the chash parameter when it is omitted by a non-compliant or misconfigured Identity Provider, which allows an attacker to substitute or inject an authorization code and potentially gain...

8.1CVSS5.9AI score0.00449EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/09/09 5:23 p.m.4 views

DRUPAL-CONTRIB-2026-151

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with the ability to configure identity...

5.7AI score
SaveExploits0References1
OSV
OSV
added 2026/09/09 5:21 p.m.10 views

DRUPAL-CONTRIB-2026-145

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenc...

5.6AI score
SaveExploits0References1
Rows per page
Query Builder