91 matches found
CVE-2020-35682
CVE-2020-35682 SD-91948: CVE-2020-35682: Authentication Bypass Vulnerability during SAML login in ServiceDesk Plus. As described by ManageEngine. If the target ServiceDesk Plus 11134 installation has SAML login enabled and you have credentials to a low privilege user then you can escalate to...
Cross-site Request Forgery (CSRF)
Overview apache-airflow-providers-amazon is a Provider for Apache Airflow. Implements apache-airflow-providers-amazon package Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the AWS auth manager SAML login flow, where login discards the AuthnRequest id...
CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...
CVE-2026-86467
The Apache Airflow Amazon provider is vulnerable to a login-CSRF attack via the AWS auth manager 's SAML login flow. The vulnerability occurs because the login handler discards the AuthnRequest ID and the callback validates assertions without requiring a matching InResponseTo value. This allows a...
CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...
Citrix NetScaler SAML RCE Chain (CVE-2023-3519)
Targets CVE-2023-3519 on Citrix ADC/Gateway SAML IdP/Gateway configurations. Confirms /saml/login processing, then attempts CVE-2019-19781 template injection as a fallback when directory traversal is available on the same appliance. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix NetScaler SA...
EUVD-2026-89499
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request...
CVE-2026-86101
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request...
CVE-2026-86101: Improper Authorization
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request...
CVE-2026-86101
A remote, authenticated SAML user can exploit an improper authorization vulnerability in the WatchGuard Fireware OS SAML login process. By sending a specially crafted request, an attacker with legitimate access only to the Access Portal can obtain unauthorized Mobile VPN with SSL access . No spec...
CVE-2026-86101 Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request...
CVE-2026-86101 Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request...
PT-2026-102950
Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description An improper authorization issue exists in the SAML login process. This allows a remote, authenticated SAML user who only has access to the Access Portal to gain unauthorized...
CVE-2026-86770
Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication. Due to the default utf8mb4_unicode_ci database collation, an attacker who registers IdP accounts with accent or case variants of a victim's username can bypass username matching and achieve account takeo...
CVE-2026-33920
A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...
Citrix NetScaler CVE-2026-8451 detection
Detects Citrix NetScaler/ADC instances vulnerable to CVE-2026-8451 by sending crafted SAML requests to /saml/login and checking the NSCTASS cookie for memory overread artifacts. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import ssl from requests.adapters import HTTPAdapter from...
CVE-2026-45688 Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's CAS login handler forwards the client-supplied options.cas.credentialToken value straight into a MongoDB findOneid: ... query...
CVE-2026-49381
JetBrains TeamCity prior to version 2026.1 is affected by a stored cross-site scripting (XSS) vulnerability on the SAML login page. The issue allows an attacker to inject content that could be rendered in the victim’s browser, with the CVSS basis indicating UI interaction is required and privileg...