CVE-2026-75807

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mosamlloginvalidate ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mosamlrequiredcertificate...

CVE-2026-75807

The SAML Single Sign On – SSO Login plugin for WordPress (versions up to 5.4.6 ) is vulnerable to an unauthenticated authentication bypass caused by X.509 certificate poisoning. The mo_saml_login_validate() ACS handler persists the X.509 certificate from an incoming SAMLResponse into the mo_saml_...

CVE-2026-75807 SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mosamlloginvalidate ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mosamlrequiredcertificate...

CVE-2026-75807 SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mosamlloginvalidate ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mosamlrequiredcertificate...

EUVD-2026-68133

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mosamlloginvalidate ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mosamlrequiredcertificate...

CVE-2026-82465

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-82465

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-82465 pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-82465 pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-82465

pac4j-saml versions before 6.5.6 fail to enforce signature validation on SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP does not send a SessionIndex, the session can be destroyed based solely on the NameID. This allows an unauthenticated attacker to submi...

EUVD-2026-68122

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-82465 pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-75807: Improper Authentication

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mosamlloginvalidate ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mosamlrequiredcertificate...

PT-2026-83445

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-82465: Insufficient Verification of Data Authenticity

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

PT-2026-83496

Name of the Vulnerable Software and Affected Versions SAML Single Sign On – SSO Login plugin for WordPress versions prior to 5.4.7 Description An authentication bypass exists due to the mo saml login validate ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse int...

The vulnerability of the lasso_provider_verify_saml_signature function in the Lasso library, which allows a hacker to trigger a service failure.

The vulnerability of the lassoproviderverifysamlsignature function in the Lasso library is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause service failures...

PT-2026-83115

Name of the Vulnerable Software and Affected Versions Rancher versions prior to 2.15.1 Description Rancher Manager contains a flaw in its SAML assertion replay protection. Consumed assertion IDs are recorded in a per-process cache, meaning each replica only detects replays that reach the same pod...

PT-2026-83116

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...

CVE-2026-79772

A flaw was found in Nokogiri. This vulnerability occurs because the canonicalize method fails to properly check the return value from an internal XML processing function, returning an empty string on failure instead of an error. A remote attacker could exploit this by providing specially crafted...