143 matches found
PT-2026-79072
Name of the Vulnerable Software and Affected Versions dropbox samly versions 0.3.0 and later Description An authentication bypass exists where an attacker can authenticate as the subject of a captured SAML assertion by resubmitting it. This occurs because the function decode idp auth resp/3 in...
CVE-2026-53424: Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decodeidpauthresp/3 in lib/samly/helper.ex calls esamlsp:validateassertion/2, whose default duplicate detector is ...
CVE-2026-10579
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted...
CVE-2026-10579
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted...
CVE-2026-9487 XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. getsignedxml in lib/XML/Sig.pm, called from verify, resolves the SignedInfo Reference/@URI to a node with the XPath expression "//@ID='$id'" and returns the first node of the resulting node set. A document in which...
PT-2026-67421
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. get signed xml in lib/XML/Sig.pm, called from verify, resolves the SignedInfo Reference/@URI to a node with the XPath expression "//@ID='$id'" and returns the first node of the resulting node set. A document in whic...
Replay Attack
Overview org.keycloak:keycloak-saml-core is an Identity and Access Management plugin for Keycloak. Affected versions of this package are vulnerable to Replay Attack through IdP-initiated broker logins in the services/src/main/java/org/keycloak/broker/saml component. An attacker can hijack a user...
Replay Attack
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Replay Attack through IdP-initiated broker logins in the services/src/main/java/org/keycloak/broker/saml...
GO-2026-5899 Casdoor doesn't enforce SAML assertion time bounds in github.com/casdoor/casdoor
Casdoor doesn't enforce SAML assertion time bounds in github.com/casdoor/casdoor...
PT-2026-53861
Name of the Vulnerable Software and Affected Versions Rancher versions 2.14.0 through 2.14.2 Rancher versions 2.13.0 through 2.13.6 Rancher versions 2.12.0 through 2.12.10 Rancher versions 2.11.0 through 2.11.14 Description A SAML authentication replay issue exists in the Assertion Consumer Servi...
CVE-2026-56223: Improper Authentication
Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a...
CVE-2026-54588 Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An...
CVE-2026-25922 authentik has a Signature Verification Bypass via SAML Assertion Wrapping
authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificate setting under...
CVE-2020-12676
FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack"...
CVE-2023-29129
A vulnerability has been identified in Mendix SAML Mendix 7 compatible All versions = V1.17.3 = V1.16.4 = V2.3.0 = V2.2.0 = V3.3.1 = V3.1.9 = V3.3.0 = V3.1.8 = V3.3.1 = V3.3.0 = V3.1.9 = V3.1.8 V3.2.6. The affected versions of the module insufficiently verify the SAML assertions. This could allow...
CVE-2025-54369
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify...
CVE-2025-54369 Node-SAML SAML Authentication Bypass
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify...
CVE-2025-46705: Reachable Assertion
A denial of service vulnerability exists in the gassertnotreached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability...
