CVE-2026-116201 Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

CVE-2026-116201 Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

EUVD-2026-109459

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

CVE-2026-116201

The software Snipe-IT versions before 8.5.0 is vulnerable to a SAML assertion replay vulnerability. The root cause is a non-atomic nonce check within the SAML acs handler , which creates a race condition . By sending concurrent POST requests to /saml/acs using a single captured assertion, an atta...

Exploit for Improper Verification of Cryptographic Signature in Onelogin Ruby-Saml

nuclei -t ./CVE-2024-45409.yaml -u http://localhost -debug -code...

PT-2026-123042

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

Ruby-SAML 1.16.0 SAML Authentication Bypass

Ruby-SAML versions through 1.12.2 and versions 1.13.0 through 1.16.0 improperly verify SAML response signatures. The included proof of concept forges SAML assertion contents and submits them to a vulnerable GitLab SAML callback. https://packetstorm.news/download/237455...

Citrix NetScaler ADC and Gateway 14.1 Authentication Bypass

Citrix NetScaler ADC and Gateway versions before the vendor-provided fixed builds contain an authentication bypass using an alternate path when configured as Gateway or AAA virtual servers, subject to version-specific SAML conditions...

CVE-2026-115546

Okta Access Gateway OAG does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console...

EUVD-2026-108568

Okta Access Gateway OAG does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console...

CVE-2026-115546 Authentication Source Verification Issue in Okta Access Gateway

Okta Access Gateway OAG does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console...

CVE-2026-115546 Authentication Source Verification Issue in Okta Access Gateway

Okta Access Gateway OAG does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console...

CVE-2026-115546

The Okta Access Gateway (OAG) contains an authentication source verification issue. The system fails to validate the selected authentication source during sign-on, allowing an authenticated user with an active session to modify the authentication source parameter. This vulnerability may result in...

PT-2026-121738

Okta Access Gateway OAG does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console...

EUVD-2026-107676

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside t...

CVE-2026-87953

Server-Side Request Forgery SSRF vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87947

Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87950

Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87952

Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87945

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...