CVE-2026-97791 Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests

In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...

CVE-2026-97791

In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...

EUVD-2026-95700

In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...

Astra Linux – Vulnerability in Lasso

There is a denial-of-service vulnerability in the gassertnotreached functionality of Entr’ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial-of-service attack. An attacker can send a malformed SAML response to exploit this vulnerability...

PT-2026-89522

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

DRUPAL-CONTRIB-2026-145

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenc...

PT-2026-89251

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently prevent reuse of previously accepted SAML assertions. Under certain circumstances, a valid assertion may be...

PT-2026-89246

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenc...

SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenc...

CVE-2026-78631

The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...

CVE-2026-78629

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...

CVE-2026-78623

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against t...

CVE-2026-78579

The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of th...

CVE-2026-78631 Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging

The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...

CVE-2026-78631

Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This improper restriction of sensitive information makes a live authentication credential readable by any local user with access to that log ...

CVE-2026-78629 Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...

CVE-2026-78629 Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...

CVE-2026-78629

The Okta Hyperdrive agent plugin contains an improper authentication verification flaw in its MFA response handling. When an organization's policy does not require MFA for a given user, the plugin returns a success response that contains only a bare boolean validation indicator rather than a sign...

EUVD-2026-74181

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...

EUVD-2026-74177

The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of th...