4687 matches found
EUVD-2026-51182
SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled...
WordPress SAML Single Sign On – SSO Login plugin <= 5.4.4 - Unauthenticated Authentication Bypass vulnerability
Unauthenticated Authentication Bypass vulnerability discovered by Supakiad S. m3ez in WordPress Plugin SAML SP Single Sign On versions = 5.4.4...
CVE-2026-58066
Rocket.Chat SAML SSO prior to versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8 and 7.10.14 verify XML signatures but do not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside a v...
CVE-2026-58066: Improper Authentication
Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside...
GHSA-3735-5339-XFWX Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
Summary Poweradmin v4.3.2 uses the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirecturi sent to the Identity Provider,...
Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
Summary Poweradmin v4.3.2 uses the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirecturi sent to the Identity Provider,...
CVE-2026-7521
Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...
CVE-2026-7521
Mattermost CVE-2026-7521 affects versions 11.8.x up to 11.8.0, 11.7.x up to 11.7.3, 11.6.x up to 11.6.5, and 10.11.x up to 10.11.20. The issue arises from a failure to verify the file deletion path in the remove file endpoint for SAML admin writes, enabling deletion of arbitrary files outside the...
CVE-2026-7521
Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...
EUVD-2026-49852
Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...
CVE-2026-7521 SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory
Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...
Improper Handling of Extra Parameters
Overview org.keycloak:keycloak-saml-core is an Identity and Access Management plugin for Keycloak. Affected versions of this package are vulnerable to Improper Handling of Extra Parameters through the generateRedirectUri logic in org.keycloak.saml.BaseSAML2BindingBuilder. An attacker can cause a...
com.eurodyn.qlack2.util:qlack2-util-sso (>=2.3.5, <=2.3.19), com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (>=24.3.0.0, <=26.7.3.0) +91 more potentially affected by CVE-2026-18217 via org.keycloak:keycloak-saml-core (>=1.2.0.cr1, <=26.7.3)
org.keycloak:keycloak-saml-core MAVEN version =1.2.0.cr1, =2.3.5, =24.3.0.0, =24.3.0.0, =2.5.6-24.0, =1.0.0-25.0, =0.1.0, =2.1, =8.1, =2.1, =4.1.0, =4.0.3, =1.0.0, =26.3.0, =26.1.0, =26.4.0, =26.7.3 and more Source cves: CVE-2026-18217 Source advisory:...
SUSE SLES16 Security Update : shibboleth-sp (SUSE-SU-2026:22854-1)
The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22854-1 advisory. This update for shibboleth-sp fixes the following issue - CVE-2025-9943: SQL injection in the ID attribute of the SAML response when the...
CVE-2026-7521: Improper Limitation of a Pathname to a Restricted Directory
Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...
Exploit for CVE-2026-15981
CVE-2026-15981 SAML Single Sign On = 5.4.4 - Unauthenticat...
Security update for shibboleth-sp (important)
openSUSE security update: security update for shibboleth-sp ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21418-1 Rating: important References: bsc1249394 Cross-References: CVE-2025-9943 CVSS scores: CVE-2025-9943 SUSE : 7.3...
CVE-2026-15981 SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mosamlvalidatesignature function performing a loose boolean check on the raw tri-state integer returned by PHP's opensslverify, causing a...
CVE-2026-15614 IdP-initiated SAML sessions not reliably invalidated (replay)
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...