POC-CVE-2026-60206

CVE-2026-60206 — Oracle WebLogic SAML 인증 우회 CVSS 9.9 — Oracle WebLogic Server Core의 SAML 인증 우회. 영향 대상: 12.2.1.4.0 14.1.1.0.0 14.1.2.0.0 15.1.1.0.0 ⚠️ 승인된 보안 테스트 전용입니다. 설치 root@kitploit: git clone https://github.com/imbas007/CVE-2026-60206.git cd CVE-2026-60206 pip install -r requirements.txt 사용법 단...

CVE-2026-19490-check

Citrix NetScaler SAML nFactor 上下文认证绕过 — 漏洞检测脚本 针对 CVE-2026-19490 的安全、未认证漏洞检查，该漏洞是 Citrix NetScaler ADC / NetScaler Gateway SAML 服务提供者路径中的预认证认证绕过（CTX696939，发布于 2026-08-19）。CWE-288，CVSS v4.0 9.3 （AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L）。由 JPMorgan Chase 渗透测试团队的 Samarth Vashisht 报告。...

CVE-2026-56207 Apache Impala: SAML authentication bypass via forged bearer token

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

CVE-2026-86304

MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parseassertion builds Net::SAML2::Binding::POST without a trust anchor. parseassertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST-new with no cacert, certtext or anchors...

CVE-2026-86304 MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parseassertion builds Net::SAML2::Binding::POST without a trust anchor. parseassertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST-new with no cacert, certtext or anchors...

CVE-2026-60206

CVE-2026-60206 – Oracle WebLogic Server SAML 认证绕过 PoC 该仓库提供了针对 CVE-2026-60206 的概念验证利用代码，这是 Oracle WebLogic Server SAML 实现中的一个关键认证绕过漏洞。该漏洞允许远程低权限攻击者通过伪造 SAML 断言完全入侵服务器。 ⚠️ 免责声明： 本工具仅限授权的安全研究和测试 使用。仅可对您拥有或获得明确许可的系统进行测试。作者不对滥用行为承担任何责任。 🔥 漏洞概述 CVE-2026-60206 影响 Oracle WebLogic Server 的核心组件。该漏洞源于 SAML...

CVE-2026-18092

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because newfromxml reads assertion identity with document-wide XPath instead of the signed subtree. newfromxml reads the NameID, attribute values, SessionIndex, audience and other identity fields...

CVE-2026-18089 Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...

CVE-2026-46423

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's SAML service provider implementation silently skips both SAML Response and Assertion signature validation when the configured Id...

CVE-2026-41005 UAA accepts SAML Encrypted Assertions authentication bypass

Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider confidentiality as a substitute for XML signatures from the Identity Provider authenticity in two SAML flows: the OAuth 2.0 SAML2 bearer grant token endpoint and browser SSO ACS when wantAssertionSigned is set to false...

GHSA-RV5F-CCPM-XJJ4 Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

PT-2025-48992

Name of the Vulnerable Software and Affected Versions Synology DiskStation DS925+ affected versions not specified Description An authentication bypass issue exists in the samlAuth component of Synology DiskStation DS925+. This allows an attacker to bypass authentication. The issue was discovered...

EUVD-2018-18723

Malware in sbrugna...

EUVD-2018-17023

Malware in sbrugna...

EUVD-2019-0609

Malware in sbrugna...

EUVD-2017-8234

Malware in sbrugna...

CVE-2025-46573 passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smuggling

passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done b...

CVE-2025-25292

Ruby-saml contains an authentication bypass vulnerability caused by a parser differential between ReXML and Nokogiri. The issue affects versions older than 1.12.4 and 1.18.0, enabling a Signature Wrapping attack that can lead to bypassing SAML authentication. A patch exists in versions 1.12.4 and...

Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)

Summary An authentication bypass vulnerability was found in ruby-saml due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping...

CVE-2025-25291 ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

ruby-saml provides security assertion markup language SAML single sign-on SSO for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely...