CVE-2026-46490-samlify-SAML-Attribute-Injection

CVE-2026-46490 — samlify SAML AttributeValue XML Injection → Privilege Escalation samlifyValue — is inserted unescaped , so a normal user can inject extra elements e.g. role=admin into their own, IdP-signed SAML assertion. Because the injection happens before signing, the Service Provider's...

shimit

shimit shimit is a python tool that implements the Golden SAML attack. More informations on this can be found in the following article on our blog. python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY --SamlValidity...

CVE-2017-11427-DEMO

CVE-2017-11427-DEMO Basic Environment $ sudo apt-get install libxml2-dev libxslt1-dev $ sudo apt-get install libxml2-dev libxmlsec1-dev libxmlsec1-openssl DEMO: $ git clone https://github.com/CHYbeta/CVE-2017-11427-DEMO.git $ cd CVE-2017-11427-DEMO $ source venv/bin/active $ cd vulnsaml $ python...

CVE-2025-23369_SAML_bypass

bypass github...

CVE-2025-12101-checker

CVE-2025-12101-checker Simple Python PoC to check Citrix NetScaler ADC / Gateway instances for CVE-2025-12101 reflected XSS on /cgi/logout using a crafted SAMLResponse + RelayState payload. ⚠️ Use this tool only on systems you own or are explicitly authorized to test. 🔍 Background CVE-2025-12101...

CVE-2022-47966_checker

CVE-2022-47966checker Quick and dirty powershell script to look for ManageEngine CVE-2022-47966 IOCs. The script will parse requests in ME HTTP access logs. If a characteristic SAML request is found, it will attempt to decode and extract the attacker's payload. Findings are written to...

CVE-2022-23131

CVE-2022-23131 CVE-2022-23131 - SAML SSO bypass fofa: app="ZABBIX-监控系统" && body="saml"...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.9 Images Security Update

New images are available for Red Hat build of Keycloak 26.6.9 and Red Hat build of Keycloak 26.6.9 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.9 Security Update

New Red Hat build of Keycloak 26.6.9 packages are available from the Customer Portal Red Hat build of Keycloak 26.6.9 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes...

keycloak-services: keycloak-services: SAML redirect binding signature bypass via percent-encoded parameter names

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names like %53AMLResponse while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to...

whiskeysamlandfriends

WhiskeySAML and Friends TicketsPlease TicketsPlease: Python library to assist with the generation of Kerberos tickets, remote retrieval of ADFS configuration settings, generation of Golden SAML tokens, and retrieval of Azure Access Tokens. WhiskeySAML WhiskeySAML: Proof of concept tool for a Gold...

Keycloak - SAML Core Package Signature Validation Flaw

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...

Apache CloudStack - SAML Signature Exclusion

The CloudStack SAML authentication disabled by default does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response...

CVE-2026-58490

The open-source security automation platform Tracecat is vulnerable in versions 0.37.0 through 1.0.0-beta.49 . In Docker Compose deployments with SAML enabled, the application may render SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty values, overriding secure defaults and disabling sig...

EUVD-2026-118485

Tracecat is an open-source security automation platform for teams and AI agents. From version 0.37.0 until 1.0.0-beta.49, Docker Compose deployments with SAML enabled can render SAMLSIGNEDASSERTIONS and SAMLSIGNEDRESPONSES as empty values, overriding secure application defaults and disabling both...

CVE-2026-19868

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication MFA...

CVE-2026-19868

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication MFA...

CVE-2026-19868

The SonicOS SSLVPN service is affected by an authentication enforcement vulnerability (CVE-2026-19868 ) that allows users with valid credentials for an alternate authentication method to bypass SAML authentication controls . This can also lead to the bypass of SAML-enforced multi-factor authentic...

EUVD-2026-118429

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication MFA...

keycloak-services: keycloak-services: Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop

A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser...