456 matches found
flask-saml2
flask-saml2 .. note:: Looking for maintainers. This project is unmaintained. The library works, or did when I last used it, but I no longer work on the project this was built for. If you are interested in taking over leadership and maintenance of this project, please get in touch. .. image::...
RHLW-2026-2CF5E53D95861E97 Lightwell Security Advisory: spring-security-saml2-service-provider 5.7.11.rhlw-00006
Red Hat Lightwell has released org.springframework.security:spring-security-saml2-service-provider 5.7.11.rhlw-00006 with backported fixes for CVE-2026-40988, CVE-2026-41003, and CVE-2026-41694. CVE-2026-40988: Unbounded DEFLATE Inflation in SAML 2.0 Service Provider CVE-2026-41003: Unencoded HTM...
CLEANSTART-2026-ZK87180 application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2
Security vulnerability affects the apache-nifi package. An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2...
PT-2026-117927
Security vulnerability affects the apache-nifi package. An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2...
[SECURITY] Fedora 45 Update: lasso-2.9.0-11.fc45
Lasso is a library that implements the Liberty Alliance Single Sign On standards, including the SAML and SAML2 specifications. It allows to handle the whole life-cycle of SAML based Federations, and provides bindings for multiple languages...
CLEANSTART-2026-SR72438 application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2
Security vulnerability affects the apache-nifi package. An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2...
ROOT-APP-MAVEN-CVE-2026-41003 CVE-2026-41003 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root
Root has patched CVE-2026-41003 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-40988 CVE-2026-40988 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root
Root has patched CVE-2026-40988 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-40993 CVE-2026-40993 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root
Root has patched CVE-2026-40993 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...
Linux Distros Unpatched Vulnerability : CVE-2026-44793
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration...
CVE-2026-44793
Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...
CVE-2026-44793 OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`
Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...
EUVD-2026-78351
Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...
CVE-2026-44793 OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`
Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...
CVE-2026-44793
Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...
CVE-2026-44793
OpenAM (Open Access Management) is vulnerable to pre-authentication reflected XSS in the SAML2 cluster cookie-hash redirect path. The root cause is inconsistent output encoding of user-supplied parameters in the FSUtils.postToTarget function. Exploitation requires a non-default clustered configur...
CVE-2026-44793 OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`
Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...
CVE-2026-44793: Improper Neutralization of Input During Web Page Generation
Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...
CVE-2026-56207
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...
EUVD-2026-74797
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...