4687 matches found
CVE-2026-18089 Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...
PT-2026-67393
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify xml when no trust anchor is configured. verify xml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig...
PT-2026-67394
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new from xml reads assertion identity with document-wide XPath instead of the signed subtree. new from xml reads the NameID, attribute values, SessionIndex, audience and other identity...
PT-2026-67395
Net::SAML2 versions before 0.86 for Perl allow authentication bypass because verify encrypted assertion accepts an EncryptedAssertion whose decrypted content carries no signature. verify encrypted assertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, v...
PT-2026-67421
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. get signed xml in lib/XML/Sig.pm, called from verify, resolves the SignedInfo Reference/@URI to a node with the XPath expression "//@ID='$id'" and returns the first node of the resulting node set. A document in whic...
CVE-2026-69092: Improper Neutralization of Input During Web Page Generation
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to...
CVE-2026-67328 @better-auth/sso before 1.6.21 Account Takeover via SSO
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflect...
CVE-2026-67328: Improper Neutralization of Input During Web Page Generation
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflect...
Replay Attack
Overview org.keycloak:keycloak-saml-core is an Identity and Access Management plugin for Keycloak. Affected versions of this package are vulnerable to Replay Attack through IdP-initiated broker logins in the services/src/main/java/org/keycloak/broker/saml component. An attacker can hijack a user...
Replay Attack
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Replay Attack through IdP-initiated broker logins in the services/src/main/java/org/keycloak/broker/saml...
com.eurodyn.qlack2.util:qlack2-util-sso (>=2.3.5, <=2.3.19), com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (>=24.3.0.0, <=26.7.3.0) +91 more potentially affected by CVE-2026-18967 via org.keycloak:keycloak-saml-core (>=1.2.0.cr1, <=26.7.3)
org.keycloak:keycloak-saml-core MAVEN version =1.2.0.cr1, =2.3.5, =24.3.0.0, =24.3.0.0, =2.5.6-24.0, =1.0.0-25.0, =0.1.0, =2.1, =8.1, =2.1, =4.1.0, =4.0.3, =1.0.0, =26.3.0, =26.1.0, =26.4.0, =26.7.3 and more Source cves: CVE-2026-18967 Source advisory:...
CVE-2026-18217
A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can...
CVE-2026-18217
CVE-2026-18217 affects Keycloak’s SAML protocol implementation, specifically when handling SAML authentication requests via HTTP-Redirect binding with wildcard redirect URLs. The root cause is a query-string handling flaw that allows an attacker to craft a request whose parameters are preserved a...
SUSE CVE-2026-9090
Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of using the trusted...
SUSE CVE-2026-9093
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/samlsp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects...
SUSE CVE-2026-9096
Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse never reads this field, meaning that time bounds are...
CVE-2026-18217: Improper Input Validation
A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can...
PT-2026-66729
A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can...
SUSE CVE-2026-55671
ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...
CVE-2026-28323 SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability
SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled...