POC-CVE-2026-60206

CVE-2026-60206 — Oracle WebLogic SAML 认证绕过 CVSS 9.9 — Oracle WebLogic Server Core 中的 SAML 认证绕过。 受影响版本：12.2.1.4.0 14.1.1.0.0 14.1.2.0.0 15.1.1.0.0 ⚠️ 仅限授权的安全测试。 安装 git clone https://github.com/imbas007/CVE-2026-60206.git cd CVE-2026-60206 pip install -r requirements.txt 用法 单个目标 检测版本 + SAML 端点...

CVE-2026-60206

🚨 CVE-2026-60206 — WebLogic SAML 接管 Oracle WebLogic Server SAML 身份验证漏洞 针对影响 Oracle WebLogic Server 的 CVE-2026-60206 的技术分析。 📖 概述 CVE-2026-60206 是一个影响 Oracle WebLogic Server 的 严重（CVSS 9.9） 漏洞。根据 Oracle 的说法，具有网络访问权限的低权限认证攻击者通过 SAML 可完全攻陷易受攻击的 WebLogic 实例。 ⚠️ 本仓库仅用于教育、防御和研究目的。 📊 漏洞详情 属性| 值 ---|--- CVE...

CVE-2022-23131

CVE-2022-23131 Zabbix SAML 認証エクスプロイト このPythonスクリプトは、Zabbixサーバー上で誤って設定されたSAML認証フローを悪用します。ZabbixサーバーのURLとユーザー（デフォルト: Admin）を指定することで、認証済みのZabbixセッション（zbxsession）を生成し、その認証済みセッションを使用してダッシュボードへのアクセスを試みます。 使用方法 スクリプトを使用するには、コマンドラインから実行し、対象のZabbixサーバーのURLを指定します。必要に応じて、ユーザーとカスタムユーザーエージェントを指定することもできます。...

CVE-2024-41107

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 我々は、テロ組織ハマスによって人質に取られたすべての市民の安全な帰還を要求します。すべての人質が解放され、無事に帰還するまで、我々は休むことはありません。あなたも彼らを家に連れ戻す手助けができます。https://stories.bringthemhomenow.net/ 🚀 CVE-2024-41107 エクスプロイト 🚀 このリポジトリには、Apache CloudStack の深刻な脆弱性 CVE-2024-41107 に対するエクスプロイトが含まれています。この脆弱性は、バージョン 4.5.0 から...

shimit

shimit shimit は、Golden SAML 攻撃を実装する Python ツールです。詳細な情報は、こちらの 記事 をご参照ください。 python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY --SamlValidity SAMLVALIDITY -n SESSIONNAME -r ROLES -id ARN -o OUTFILE -l LOADFILE -t TIME ██╗...

CVE-2026-60206

CVE-2026-60206 – Oracle WebLogic Server SAML 認証バイパス PoC このリポジトリは、Oracle WebLogic Server の SAML 実装における重大な認証バイパス脆弱性である CVE‑2026‑60206 の概念実証エクスプロイトを提供します。この欠陥により、リモートの低権限攻撃者が SAML アサーションを偽造してサーバーを完全に侵害できます。 ⚠️ 免責事項: このツールは認可されたセキュリティ研究およびテストのみ...

CVE-2026-19490-check

Citrix NetScaler SAML nFactor 上下文认证绕过 — 漏洞检测脚本 针对 CVE-2026-19490 的安全、未认证漏洞检查，该漏洞是 Citrix NetScaler ADC / NetScaler Gateway SAML 服务提供者路径中的预认证认证绕过（CTX696939，发布于 2026-08-19）。CWE-288，CVSS v4.0 9.3 （AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L）。由 JPMorgan Chase 渗透测试团队的 Samarth Vashisht 报告。...

CVE-2026-55210: Authentication Bypass by Spoofing

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin returns an existing account matched by an IdP-asserted email without checking the account's isexternal flag. In deployments using mixed loca...

USN-8770-1: SimpleSAMLphp vulnerabilities

It was discovered that SimpleSAMLphp incorrectly validated cryptographic signatures in XML messages. An authenticated attacker could possibly use this issue to impersonate users or gain elevated privileges. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. CVE-2019-3465 It was...

PT-2026-93223

Name of the Vulnerable Software and Affected Versions Secret Server affected versions not specified Description Under certain conditions, a valid SAML IdP response may be used to impersonate another user. SAML Security Assertion Markup Language is an XML-based standard for exchanging authenticati...

GHSA-H8M9-JGF8-VWVP Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

SAML Tenant Binding Enables Cross-Tenant Account Takeover Summary Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token. A malicious tenant with its own SAML configuration and a self-controlled IdP could...

HPESBMU05142 rev.1 - HPE IceWall products, Remote Bypass of Security Restrictions

Potential Security Impact: Remote: Bypass Security Restrictions SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. IceWall MFA 4.0 Enterprise Edition - SAML Authentication Option RHEL7, RHEL8, RHEL9, RHEL10, Windows IceWall MFA 4.0 Standard Edition - SAML Authentication Option RHEL7,...

DRUPAL-CONTRIB-2026-143

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorange\saml module does not sufficiently validate certain user-supplied URLs before performing redirects. An attacker could cause users...

CVE-2026-86770

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4unicodeci database collation t...

CVE-2026-86770 Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4unicodeci database collation t...

EUVD-2026-74947

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4unicodeci database collation t...

CVE-2026-56207 Apache Impala: SAML authentication bypass via forged bearer token

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

CVE-2026-56207 Apache Impala: SAML authentication bypass via forged bearer token

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

PT-2026-89039

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description Insufficient validation of username case sensitivity during SAML authentication allows attackers to authenticate as other users. By registering Identity Provider IdP accounts using case or accent...

CVE-2026-86770: Improper Handling of Case Sensitivity

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4unicodeci database collation t...